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HEARING V ON YEAR 2000 READINESS IN THE 
DEPARTMENT OF VETERANS AFFAIRS 


THURSDAY, OCTOBER 28, 1999 

House of Representatives, 
Subcommittee on Oversight and Investigations, 

Committee on Veterans’ Affairs, 

Washington, DC. 

The subcommittee met, pursuant to call, at 10:04 a.m., in room 
334, Cannon House Office Building; Honorable Terry Everett 
(chairman of the subcommittee) presiding. 

Representatives present: Everett, Brown, and Udall. 

OPENING STATEMENT OF CHAIRMAN EVERETT 

Mr. Everett. The hearing will come to order. 

Let me say at the outset I will try to get through my statements 
and questions. I had some drops put in my eyes and I can’t see the 
script that well. 

Good morning. The hearing will examine the final preparations 
of the Department of Veterans Affairs for the year 2000 computer 
compliance. 

This is our fifth hearing on Y2K. Today we are 63 days from year 
2000. We will hear testimony from the GAO, the VA, and the FDA 
on how prepared the VA and FDA will be on January 1, 2000. 

Today we will stress the VA’s readiness to provide iminterrupted 
veterans benefits, veterans compensation and pension checks, safe 
medical care, and prescriptions when the moment arises. 

I cannot overstress the importance of the VA being as fully pre- 
pared as possible. No detail can be left umanticipated and 
unaddressed. There cannot be any attitude of “this won’t happen.” 
Contingency plans c^not merely accept verbal agreements or as- 
surances from suppliers for such things as emergency generators, 
fuel supplies, alternative water sources, and food shipments. Every- 
thing must be narrowed down to the greatest possible extent. 

When the VA facihties run Y2K drills and exercises, they need 
to seriously address ^d correct identified deficiencies. Veterans de- 
pend on the professionalism, thoroughness and keen attention to 
detail of the VA as the department completes its Y2K preparation. 

We have a lot to cover. Now I would like to recognize our ranking 
Democrat, Corrine Brown. 

OPENING STATEMENT OF HON. CORRINE BROWN 

Ms. Brown. Thank you, Mr. Chairman. Well, here we are again, 
Mr. Chairman, trying to reassure America’s veterans and their 

( 1 ) 
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families that VA hospitals will operate normally on New Year’s 
morning and that all checks will be delivered on time. 

Today it will be nice to hear VA report on how it is really ready 
to roll over into the year 2000 and how it received two “A’s” last 
month from the House Oversight Committee that was grading Y2K 
government efforts. 

It also will be nice to hear the Food and Drug Administration say 
how much confidence it has that essential medical supplies will be 
available, that medical devices will function as intended, and that 
there will be a safe and adequate supply of drugs available. 

I am concerned, however, Mr. Chairman, that all of today’s nice 
talk will be meaningless if VA has to walk its walk in a community 
that is shut down by a massive power outage or in a town where 
the water supply has been cut off for a long time. 

I am sure VA will tell us each of its facilities is planning on such 
contingencies. The real answer to how well VA’s decentralized 
health care system has done its local planning and will not come 
today, but at midnight on January 1. 

I appreciate the dedication of those VA employees who plan to 
give up their New Ye 2 U'’s holiday to ensure that America’s hospital- 
ized veterans might celebrate the new millennium in comfort and 
safety. To the Department of Veterans Affairs and all of those it 
serves, I wish you a smooth and uneventful new year. 

Mr. Chairman, I know that GAO has some continuing concerns. 
I want to say for the record how much I appreciate GAO’s diligence 
in keeping VA and FDA’s feet to the fire over the past 2 years. 

VA’s Office of Inspector General also has been active in assisting 
the department get ready for the new year rollover. 

Inspector General Griffin is not testifying here today, Mr. Chair- 
man, but I would ask that his letter to me dated October 25, 1999, 
outlining the work of his office in this matter be made part of the 
record. 

Mr. Everett. Without objection. 

(The letter follows;) 
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DEPARTMENT OF VETERANS AFFAIRS 
Inspector General 
Washington DC 20420 


OCT 2 5 1999 

The Honorable Corrine Brown 
Ranking Democratic Member, 

Subcommittee on Oversight and 
Investigations, Committee on Veterans’ Affairs 
House of Representatives 
Washington, DC 20515 

Dear Congresswoman Brown: 

In response to your request, we are providing a summary of our review involving the 
Department of Veterans Affairs (VA) efforts to address Year 2000 (Y2K) issues and 
become Y2K compliant. As we discussed in our April 1999 testimony before the 
Subcommittee, the Office of Inspector General (OIG) has been involved with review and 
oversight of the VA’s Y2K implementation efforts since 1997. Given the importance of 
correcting Y2K problems in VA computer systems and ensuring that veterans receive 
uninterrupted services, we are continuing to provide the Department with input and 
support as the millennium approaches. 

Our review work has shown that VA’s Y2K efforts were well organized and focused on 
those mission critical systems that must be compliant to ensure that veterans receive 
uninterrupted services. VA has reported that it has successfully completed 
implementation of all mission critical systems and is now engaged in completion of 
necessary contingency planning actions leading up to and including the “Day One 
Rollover”. 

Our focus on Y2K issues has been to identify areas where VA’s implementation efforts 
could be strengthened and to respond to any Department requests for assistance. During 
1999, our Y2K related efforts have included: (I) issuance of an audit report on VA’s 
Y2K Implementation Effort in June 1999, (2) issuance of an Advisory on the Status of 
Selected Y2K activities in VA in September 1999, and (3) completion of site visits to 
selected VA facilities to further assess Y2K implementation actions. 

On June 10, we issued an audit report on VA’s Y2K Implementation effort. During our 
April 15 testimony before the Subcommittee, we discussed the audit results that 
identified a number of key actions that could help make VA’s Y2K efforts more 
successful, reduce operating costs, and ensure continuity of operations beyond the 
millennium. The report recommended that the Acting Assistant Secretary for 
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The Honorable Corrine Brown 

Information and Technology assure that necessary corrective actions be accomplished to 
address the Y2K. weakness identified. Specifically, we recommended: 

• Completing contacts with Electronic Data Interchange trading partners (vendors) and 
Value Added Networks (VAN) to determine their Y2K compliance to assure 
continued electronic processing of transactions involving VA purchases. 

• Establishing a ‘cutoff date for VA facilities to take biomedical devices of unknown 
Y2K status out-of-service and complete plans for replacement so that necessary 
procurement lead time is available and replacement costs can be identified as soon as 
possible. 

• Completing corrective actions that were initiated during the course of the audit in 
response to our Interim Advisory Letters to address other Y2K weaknesses. 

The Acting Assistant Secretary for Information and Technology concurred with the audit 
findings and recommendations presented in the report and provided appropriate 
implementation actions. Also, in response to our findings the Acting Assistant Secretary 
requested additional assistance to conduct follow-up site visits to VA facilities to further 
assess reported Y2K implementation actions. 

In response to the Acting Assistant Secretaiy’s request, we conducted follow-up meetings 
with him and the VA Y2K Project Manager, the Veterans Health Administration (VHA) 
Y2K Project Manager, and the Veterans Benefits Administration (VBA) Project Manager. 
These meetings identified some continuing areas of concern involving VA field facility 
Y2K implementation efforts. 

On September 15, we provided the Acting Assistant Secretary for Information 
Technology with an Advisory on the Status of Y2K. Activities in VA. The Advisory 
alerted him to some areas of concern that we identified during our meetings with VA 
Y2K officials, and discussed additional review work that we planned to complete. 

We advised that while renovation of VA mission critical systems had been completed, our 
meetings with VA Y2K officials identified some concerns regarding the completion of 
other actions involving field level Y2K implementation efforts in both the Veterans 
Health Administration (VHA) and the Veterans Benefits Administration (VBA). These 
concerns have developed due to the decentralized nature of required Y2K implementation 
actions that make it difficult for Department officials to efficiently monitor the 
compliance process. The following areas of concern were identified: 



5 


3. 

The Honorable Corrine Brown 

• VHA issued guidance to field stations on the completion of a Customized Local 
Contingency Plan. Contractor Personnel and VA employees knowledgeable in 
contingency plans have reviewed ail of the plans completed by the field stations. 
However, some of the plans consisted of only copies of the guide sent out by the Y2K 
project management staff, and were not customized to address individual facility 
plaiming needs. 

• VHA has issued requirements that alt biomedical devices in veterans’ homes be 
assessed. Home Based Health Care Services and Prosthetics Services have been 
tasked with identifying and assessing devices located outside the medical centers. 
The VHA project management staff has not required any reports on the status of this 
initiative. As a result, VHA staff is depending on the local &cility to ‘follow through’ 
with the plan. 

• VHA directives require that Medical Center Directors certify that any biomedical 
device evaluated non-compliant or unknown has been assessed. If they intend to 
continue to use a device beyond December 31, 1999, the Director must certify that 
he/she has had the risk evaluated by a committee and must describe the contingency 
plan or why the non-compliance is considered a non-factor. For devices assessed as 
conditionally compliant, the same certification was required by September 1. The 
VHA Y2K staff is not routinely reviewing or controlling these certifications. 

• VHA Project Management staff indicated that they are concerned about the results of 
the mandked Emergency Electrical Power tests that were to be conducted by August 
31. This test required that all facilities operate with only the emergency generators 
while completely disconnected from local power provideis. The Y2K staff is 
concerned that the test itself was poorly conducted or not run at all. 

• VBA has required certifications fiom the General Services Administration regarding 
the compliance of buildings. We have been advised that some of the buildings are 
still not Y2K compliant. 

• VBA has not gotten assurance that outbased activities are properly prepared for 
infrastructure failures. With the opening of outbased claims processing activities on 
military bases, kiosks in mall for veterans to begin the claims process, and access to 
veterans’ claim data by Service organization, infiastructure support issues become 
more immediate. The VBA Y2K Project Manager indicated that she had no 
knowledge as to whether or not anyone had verified the infrastructure support issues 
for those remote sites not located on VA stations. This would include outbased 
veterans assistance centers, outbased field examiners, and others. 
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The Honorable Coirine Brown 


Because of current resource constraints, we advised the Acting Assistant Secretary that 
we were not tdsle to complete a foIIow-up audit. As an alternative, we are completing 
informaticm surveys oii selected Y2K areas of concern to gather information on foe status 
of unplementation actions during site visits to VA Medical Centers (VAMC) and 
Regio^ Offices (RO) as part of other ongoing OIG projects. The sites select for 
conduct of foe survey were those to be visited by OIG staff conducting foe 
Congressionally mandated Audit of Department of Veterans Affairs Consolidated 
Financial Statements for Fiscal Years 1999 and 1998 and Combined Assessment Program 
reviews at VAMCs. The eight sites selected for review included: 


VAMC Albuquerque, NM 
VAMC Arm Arbor, MI 
VAMC Durham, NC 
VAMC Philadelphia, PA 


VARO Philadelphia, PA 
VAMC Portland, OR 
VAMC Syracuse, NY 
VAMC Wichita, KS 


To date, we have completed information surveys at VAMC Aim Arbor, MI and VAMC 
and VARO Philadelphia, PA. These surveys have found that Y2K implementation 
actions have been completed in foe areas of concern that we reviewed involving medical 
devices, utility systems, and preparedness. We expect to complete foe remaining siu^eys 
in the next 30 days. 


We appreciate foe opportunity to provide input on our review and oversight of VA’s Y2K 
implementation efforts. A copy of this letter was also provided to the Chairman, 
Subcommittee on Oversight and Investigations. 
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Ms. Brown. A June 1999 IG audit found that VA’s Y2K efforts 
were well organized and focused on those mission critical systems 
that would ensure interrupted services. 

In August 1999, after concurring with the audit’s finding, the VA 
provided appropriate action to implement its recommendations. 

Mr. Chairman, I request that my entire statement be placed in 
the record that we move on with the hearing. 

Mr. Everett. Without objection. Thank you very much. 

[The prepared statement of Congresswoman Brown appears on p. 

25 .] 

Mr. Everett. I will now introduce panel 1, Joel Willemssen, Di- 
rector, Civil Agencies Information Systems, Accounting and Infor- 
mation Management Division of the GAO, and ask bim to intro- 
duce his panel. 

Before you begin, Mr. Willemssen, again I want to commend and 
thank you on behalf of all Americans, especially America’s veter- 
ans, for you and your staffs hard work in watchdogging the VA’s 
Y2K efforts. I know a lot of hard work, many hours and weekends 
were spent by you and your staff over the last 3 years to evaluate 
and produce this testimony. You have performed an invaluable 
public service to this country and to this country's veterans. 

I would also like to associate myself with the remarks of Ms. 
Brown on the contribution made by the VA’s Inspector General. 

If you will now introduce your staff and proceed, I would appre- 
ciate it. 

STATEMENT OF JOEL C. WILLEMSSEN, DIRECTOR, CIVIL 

AGENCIES INFORMATION SYSTEMS, ACCOUNTING AND IN- 
FORMATION MANAGEMENT DIVISION, GENERAL ACCOUNT- 

ING OFFICE, ACCOMPANIED BY HELEN LEW, ASSISTANT DI- 
RECTOR, CIVIL AGENCIES INFORMATION SYSTEMS 

Mr. Willemssen. Themk you, Mr. Chairman, Ranking Member 
Brown. Thank you fOr inviting GAO to testify today. Accompanying 
me is Helen Lew, Assistant Director. 

As requested, I will briefly summarize our statement. 

Overall, VA continues to make progress on Y2K. For example, 
both VBA and VHA have completed key testing of mission critical 
systems. 

Second, VHA’s consolidated mail outpatient pharmacies have de- 
veloped business continuity and contingency plans to address any 
Y2K-induced disruptions that may occur. 

In addition, VA has established a moratorium on software 
changes to help ensure that Y2K readiness is maintained through 
the rollover period. 

Further, VA has developed a day one strategy, laying out its 
plans and procedures for the late December, early January time 
period. 

VA is to be commended for this progress and for reducing the 
risk of Y2K disrupting service to our veterans. 

Mr. Chairman, your subcommittee has been instrumental in this 
progress. Dating back to 1996, long before many knew what Y2K 
was, your subcommittee was providing oversight of VA’s Y2K ef- 
forts, oversight that has led to substantial improvements in VA’s 
program. 
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Even with these improvements and the progress that has been 
made, VA’s job is not done. The department must still complete nu- 
merous tasks in the limited time remaining to further reduce the 
risk of Y2K-induced disruptions. 

For example, as of October 22 only five of VBA’s 58 regional of- 
fices had completed testing of their business continuity and contin- 
gency plans. 

Second, VHA acknowledges that the reports used to measure 
medical facilities’ progress in implementing Y2K compliant systems 
are inaccurate. It is critical that these reports be accurate so that 
any problem areais can be identified and resolved. 

Third, we believe VHA needs to reassess its position of not test- 
ing any biomedical equipment items. Our review of manufacturers’ 
web sites found at least 30 companies that encourage users to test 
certain biomedical equipment, and 15 of these provided information 
such as testing instructions. For these types of instances in which 
the manufacturer is encouraging users to test, VHA should recon- 
sider its current policy of not testing. 

Fourth, we believe that VHA needs to continue to follow up with 
pharmaceutical and medical surgical firms on their compliance sta- 
tus and make this information available on VA’s web site. 

Next, turning briefly to FDA, it too has made progress by con- 
tinuing to make compliance information on biomedical equipment 
available to users through its clearinghouse. FDA has also recently 
addressed our concern about the lack of independent verification of 
critical care and life support biomedical equipment by reviewing a 
sample of manufacturers’ Y2K activities. 

In the limited time remaining FDA still needs to finalize its re- 
port on this and make the results available to the public. 

FDA is also conducting surveys to determine the Y2K readiness 
of pharmaceutical, biological and consumable medical product man- 
ufacturers. FDA needs to follow through on its plans to publicize 
the results of its surveys in all of these areas. 

That concludes a brief summary of my statement, and I would 
be pleased to address any questions you may have. Thank you. 

[The prepared statement of Mr. Willemssen appears on p. 27.] 

Mr. Everett. Thank you very much. With the agreement of my 
ranking member,.! will hold myself to 5 minutes and you’ll take 
5 minutes, and then we will have another round. 

Chairman Horn’s Subcommittee on Government Management 
and Information Technology of the Committee on Government Re- 
form recently gave grades on Y2K preparedness. The VA was one 
of only three agencies to receive a grade of “A”. Of these three, VA 
is by far the largest and the most complex. Does GAO agree with 
this assessment of the VA? 

Mr. Willemssen. Chairman Horn puts his quarterly grades to- 
gether based on the quarterly reports submitted by the 24 depart- 
ments and agencies, and we assist him in that endeavor. Based on 
the criteria he uses, which is self-reported information, we would 
concur with his assessment. However, if an “A” implies that VA 
has completed its work on Y2K, then we would not concur with 
that assessment based on the independent work that we have done 
in identifying some additional tasks that still need to be completed 
in the remaining weeks. 
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Mr. Everett. I do not want to interpret Chairman Horn’s grad- 
ing system, but is his grading system based on A-plus being per- 
fect, or is it in relationship to where the other agencies are? 

Mr. WiLLEMSSEN. He has often said he does not grade on the 
curve. The initial baseline for his grade is the percentage of mis- 
sion critical systems at any ^ven point in time that are considered 
compliant. Then he uses additional criteria in areas such as embed- 
ded chips, telecommunications, business continuity and contingency 
plans. Based on what the agencies have said on those areas and 
how much progress they have made, he then adjusts the grade. 

I think it is worthwhile noting that over time the overall govern- 
ment-wide grade, along with VA’s grade, has escalated as Y2K has 
become a much higher priority to top management, not only at VA, 
but government-wide. 

Mr. Everett. VHA estimates over 95 percent of its devices are 
compliant; 3 or 4 percent require an upgrade; the remainder are 
simply non-compliant. VA appears fairly confident with its Y2K 
biomedical preparation. Is GAO comfortable with such an 
assessment? 

Mr. WiLLEMSSEN. We have two caveats to that overall assess- 
ment. One is to keep in mind that the information provided is 
based on what biomedical equipment manufacturers are stating in 
their compliance statements. That is why we are very reassured 
that for critical care and life support items FDA is following up and 
doing some independent work in that regard. 

Second, I briefly mentioned that there are inaccuracies in some 
of VA’s reports from their medical facilities. That is another caveat 
in terms of our comfort level in making sure that those reports are 
accurate so that top management at VA knows exactly where they 
stand. 

Mr. Everett. In your overall review of VHA medical facilities 
did you find any general deficiencies? What about critical ones re- 
lated to particular facilities? How about planning associated with 
critical delivery like patient care, intensive care, and operating 
rooms? 

Mr. WiLLEMSSEN. First, overall we again have seen tremendous 
progress in VHA’s efforts with their medical facilities. In particu- 
lar, they have done some good work in getting the ball rolling in 
the business continuity and contingency planning area. However, 
in looking at some of those contingency plans, we did note that the 
necessary detail in laying out exactly the tasks to be done, espe- 
cially in the late December, early January time frame, were not al- 
ways discussed. We know that VHA is following up on that and 
planning to address that. 

In addition, I believe a couple of plans did not give a lot of detail 
in terms of completing the templates that were required as part of 
the contingency plans. 

Mr. Everett. VA reported to the GAO 18,000 non-compliant bio- 
medical devices. Could GAO determine VA’s status on these assess- 
ments of renovations of these devices? 

Mr. WiLLEMSSEN. From a universal perspective, no, we could not. 
My caveat on that is that some of the reports from the medical fa- 
cilities were not totally accurate. For example, we saw some cases 
of percentages exceeding 100 percent. With those kind of inaccura- 
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cies we couldn’t absolutely be certain that the data there was good 
enough to satisfy us, and also VHA acknowledged some of those 
data deficiencies and is actively following up on them now. 

Mr. Everett. Has VA tested biomedical devices that are inter- 
dependent on other pieces of equipment that may experience Y2K 
problems? Does VA know how many of these devices must operate 
in conjunction with others? 

Mr. WiLLEMSSEN. VHA’s position is for the piece of equipment in 
^d of itself it does not want to independently test. However, when 
it works with an interface with another piece of equipment or, let’s 
say, a personal computer, they do plan to test that. I do not have 
at my disposal all the results of those tests. 

One thing that we would like to see VHA consider, though, is for 
those biomedical equipment items where the manufacturer has en- 
couraged users to test and in some cases actually laid out the test- 
ing instructions, we think VHA needs to reassess its position of not 
testing any equipment items. 

Mr. Everett. Thank you. Ms. Brown. 

Ms. Brown. Thank you, Mr. Chairman. 

GAO has done a lot of heavy lifting in the area of Y2K readiness 
over the last 3 years. I personally appreciate the service that you 
provided this subcommittee and your pushing VA and FDA in a de- 
fined direction toward the Y2K finish line. As January 1 nears, 
how would you summarize the lessons learned from this complex, 
high tech exercise, and what would you say were the most useful 
b 3 q)roducts of our joint efforts? 

Mr. WiLLEMSSEN. Among the most key of the lessons learned 
through this exercise is that VA top management now very well 
imderstands the criticality of information technology. In this day 
and age, it is very difficult to delivery benefits and services without 
the information technology that we are so reliant on. I think Y2K 
has assisted the department in making it aware of technolog/s 
paramount importance. 

Secondly, we hope that some of the best practices that VA has 
adopted through this exercise over the last few years can be taken 
and used on some of the other management areas within informa- 
tion technology at the department. VA has occasionally had dif- 
ficulties managing other aspects of its information technology re- 
sources. To the extent that they can use some of the lessons from 
Y2K and better manage the entire information technology environ- 
ment, I think that would be very beneficial not only for the depart- 
ment, but for our veterans. 

Ms. Brown. Being a former teacher myself, on a scale of one to 
ten, how would you rate VA? 

Mr. WiLLEMSSEN. I guess it would be difficult to give an exact 
number, but at this point in time I would ^ve them a much higher 
number than I would have when we initially started our work a 
couple of years ago. I would not give them a ten, because a ten im- 
plies that everything is done. As I have testified, everything is not 
yet done. But I would definitely give them a fairly high number 
given the kind of progress they have made, the kind of priority that 
Y2K has been in the department for sometime, and the responsive- 
ness that they have had to the recommendations that we have of- 
fered to them. 
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Ms. Brown. In comparison to the other agencies? 

Mr. WiLLEMSSEN. VA is among the better agencies of those that 
we have reviewed. As the Chairman mentioned in one of his early 
questions, VA faces a tremendous amount of complexity that sev- 
eral other departments and agencies do not, especially when it 
comes to all the medical facilities. They run a much larger risk of 
disruptions, especially during the early January rollover period, be- 
cause of the massive environment that they are responsible for and 
the criticality of information technology. 

Ms. Brown. Thank you. 

Mr. Chairman, I 3deld back. 

Mr. Everett. Mr. Udall. 

Mr. Udall. Thank you, Mr. Chairman. I also want to thank the 
two panelists from the GAO for being here with us today. 

Except for the issue of independent testing of medical devices 
that have been certified as Y2K compliant by the manufacturer, 
you note that the VA has been very responsive to your rec- 
ommendations. What are the top five things that the VA needs to 
do right now? Do they still have time to do them, and what would 
be the consequences of their not doing them? 

Mr. WiLLEMSSEN. I think, one, they do have time to address the 
areas that I will mention in terms of the top five. 

First, on business continuity and contingency plans, they need to 
make sure that those plans are thoroughly tested both at their re- 
gional offices and at their medical facilities. 

Secondly, more detail on the medical facilities and their contin- 
gency plans is needed. We pointed out some of the excellent work 
that has been done in terms of looking at what would happen at 
those facilities if they lost power. We think they could also benefit 
greatly by looking at the risk of losing other things such as water 
or gas and what those facilities would do as a backup in that 
situation. 

Third, some of the consolidated mail outpatient pharmacies still 
need to make sure that their business continuity plans are not only 
tested but they are integrated with the medical facilities. 

Fourth, we would like to see VHA follow through with the firms 
in the surveys that they have performed in the pharmaceutical, 
biologies and consumables area. They have done some excellent 
work, obtained some data, but again we do not think the job is 
done. It is irnportant to follow up with those companies who said 
they were going to be compliant by certain dates and make sure 
that indeed they are done. 

Last, I would still want to emphasize in the biomedical equip- 
ment area the need to take a second look at those items where 
manufacturers are saying “we think you should test.” I think VHA 
needs to reassess its decision not to test an3rthing. 

Mr. Udall. Do they understand what kind of testing you are 
talking about as far as medical equipment? 

Mr. WiLLEMSSEN. Yes. In several cases the manufacturer actu- 
ally lays out the test protocols and instructions. To be fair to VHA, 
we are a little late coming to this game too, because we initially 
shared VA’s concern about going in and testing these devices and 
possibly doing harm to them. But then we started looking into this 
a little bit more. 
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My eyes were especially opened at a congressional field hearing 
in San Jose in August where representatives from Hewlett-Packard 
testified and said they strongly encourage users to test because of 
the way that the systems may be set up. That is when we started 
doing more work and looking at manufacturers’ web sites, and we 
identified many manufacturers actually encouraging that testing. 

Frankly, I think over a period of time the ratio has changed. I 
think more and more manufacturers are seeing the benefit of get- 
ting users involved in the testing rather than just relying on their 
own certifications. 

Mr. Udall. Thank you very much. I yield back my time. 

Mr. Everett. Thank you. 

Let me again thank you very much for your testimony here today 
md the good work you have done for this country and its veterans 
in what we all thought was going to be a really, really tough road. 
I think all over the nation many people still are sort of worried 
about it. Thank you very much. 

Mr. WiLLEMSSEN. Thank you, Mr. Chairman. 

Mr. Everett. I would like to introduce Mr. William Hubbard, 
Senior Associate Commissioner for Policy, Planning and Legislation 
for the Food and Drug Administration. 

Mr. Hubbard, if you would introduce those members of the panel 
with you, and after that, if you would proceed with your opening 
statement, I would appreciate it. 

STATEMENT OF WILLIAM K. HUBBARD, SENIOR ASSOCIATE 

COMMISSIONER FOR POLICY, PLANNING AND LEGISLATION, 

FOOD AND DRUG ADMINISTRATION, ACCOMPANIED BY 

THOMAS B. SHOPE, SPECIAL ASSISTANT TO THE DIRECTOR, 

OFFICE OF SCIENCE AND TECHNOLOGY, CENTER FOR DE- 

VICES AND RADIOLOGICAL HEALTH, AND MARK 

GOLDBERGER 

Mr. Hubbard. Mr. Chairman, I am joined here by Dr. Mark 
Goldberger, a drug expert and Y2K coordinator for pharmaceuticals 
at the FDA. To my left is Dr. Tom Shope, a medical device expert 
and our Y2K coordinator for medical devices. 

We have a written statement for the record. I will say just a few 
opening remarks, if I may. 

Mr. Everett. Without objection. 

Mr. Hubbard. When we were here in the spring the committee 
had concerns that the VA and other hospitals might have device 
failures that could harm veterans and other patients, and also con- 
cerns that the nation’s veterans and other patients might not have 
access to needed pharmaceuticals and medical supplies. So let me 
tell you today what we have done since that time to address those 
issues. 

For medical devices, the problem was focused on devices that 
may cause harm if a device failed because of a date-dependent 
problem. We identified the manufacturers of devices that are poten- 
tially high risk if a Y2K failure should occur. That number turned 
out to be just over 300 manufacturers, representing about 90 types 
of computer controlled devices. 

We then launched intensive audits of a sample of 80 of those 300 
manufacturers. I am pleased to tell you today, Mr. Chairman, that 
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none of the audits raised significant concerns about failure of man- 
ufacturers to properly address computerization of their devices. 

For drugs and medical supplies, working under the leadership of 
the VHA, we have surveyed the industry to ask if their manufac- 
txiring processes are Y2K compliant. This was done both to gather 
information about these products, that they would be safely made, 
and to be able to assure the public that their prescriptions can and 
will be filled after January 1. 

We followed the survey with comprehensive audits of a list of pri- 
ority firms. These are firms that are the only manufacturer of a 
particularly important drug or so-called orphan drug and the top 
200 selling prescription drugs. Again, I am pleased to inform you 
that for those priority firms the vast majority, over 95 percent, are 
Y2K compliant, and that none of these manufacturers are expected 
to experience problems that would deprive patients of critically 
needed drugs and medical supplies at the beginning of the year. 

We have also done a number of other things to help with the sit- 
uation. We have done outreach to hospitals to make sure that they 
understand that they should avail themselves of the information, 
particularly on medical devices, that the fix is by and large there. 

I think you will hear later that the VA has done a great job and 
has availed themselves of information. There is some information 
from GAO and others that perhaps some hospital systems have not 
done that. Although that is not FDA’s responsibility, I do believe 
others have raised that concern. Clearly the information is out 
there from the manufacturers on the FDA web site or on other 
manufacturers’ web sites about what devices are compliant and 
what are not and how to get the fixes for those that are not. 

We have also done a number of things to assure the public about 
this through our 800 number, our web site, various brochures and 
articles and other things to get the word out that patients need not 
worry that these products will not be available. 

And we have set up emergency operations and day one oper- 
ations at FDA which will be manned 24 hours beginning next 
month. That will be available. If any issues or any problems ap- 
pear, we will have teams of medical experts and engineers and oth- 
ers ready to go out and talk to companies or hospitals or anyone 
else that may give us information about a problem. We hope that 
doesn’t happen, but we will do that. 

I would also like to say the industry, Mr. Chairman, has re- 
sponded appropriately to this challenge and they have invested the 
resources and the time to make their systems compliant, and the 
vast majority of companies have been very responsible in this area, 
in our opinion. 

In conclusion, Mr. Chairman, we have attempted to do a graphic 
representation of our findings. As you can see from this sample to 
my left, if the firms that we have surveyed and audited came in 
about a third, a third, a third — ready, possible problems, or clearly 
a problem — we would see a chart that looks something like this 
with a third red, a third green, and a third yellow, green of course 
being ready, and red of course being a problem. 

Let me tell you how the real results came out. 

For the potential high risk devices, those that if they fail because 
of a date-related problem would cause risk to humans, we have a 
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wonderful response rate. Based on those that we have audited of 
those priority firms, 100 percent are ready. 

For the consumable medical supplies, things like blood bags and 
tubing and hemodialysis filters, the things that hospitals need 
every day, we again have found 100 percent readiness. We have a 
few questions, but we have colored them in green because we in 
fact do believe they are ready, and these questions that we have 
are very minor. 

For pharmaceuticals we have a very good record. We have only 
found one firm that we could categorize as a yellow, as having 
some issues, and we are working with that firm to make sure that 
those are not indeed problems. 

Lastly, biologicals, things like vaccines and blood banks. We also 
have a very good report. 

In summary, Mr. Chairman, across the industry that we regulate 
we believe that the signals are all go, that the industry has done 
what needs to be done, and there will not be problems. We will of 
course continue to monitor and make sure that this is in fact the 
case come January 1, but we are very optimistic. 

With that, Mr. Chairman, I will conclude my remarks and be 
happy to take questions. 

[The prepared statement of Mr. Hubbard appears on p. 79.] 

Mr. Everett. Thank you very much. Mr. Hubbard, FDA con- 
ducted a survey of manufacturers for potentially high risk devices. 
Of the 803 manufacturers, 325 were randomly selected. Of these, 
26 declined to participate and 4 did not respond. Are the names of 
the non-participants and the non-respondents public? 

Mr. Hubbard. We have not made them public. Under the Y2K 
Readiness and Disclosure Act, we have attempted to keep specific 
information about firms confidential. These firms that have not 
been audited are a range of firms, some that were simply busy try- 
ing to get their work done or were being merged with another com- 
pany or had recently been inspected by the FDA. We don’t think 
any are a problem with the possible exception of one, a blood trans- 
fusion software manufacturer in a foreign country that we intend 
to look very closely at. 

We have not put their names out in the public for fear that it 
would provide a connotation that there is a problem with these 
firms that we don’t believe exists. However, if the committee would 
like more detailed discussions about who they are, we would be 
glad to do that with the committee. 

Mr. Everett. I would like more detail. How can you be so sure 
that there are no problems if they didn’t respond? 

Mr. Hubbard. Let me ask Dr. Shope to elaborate. 

Dr. Shore. I think there are no absolute certainties due to a lack 
of response, but we have looked at not only the firm and the fact 
they didn’t respond, but what kind of products they make and what 
could be the impact of that type of product having a problem. By 
and large these firms do not make the kind of products whose fail- 
ure would be an immediately critical problem. The firms have re- 
ported for their products their date functionality or dependencies, 
and many of them don’t have any date functionality in their 
products. 
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I think we have a fair level of confidence that the firms, even the 
ones we haven’t audited, are not making the kind of products that 
would present real issues because of their date functionality. 

Mr. Everett. Doctor, that begs the question. Why wouldn’t they 
respond? 

Dr. Shore. I think for the firms there are a number of valid rea- 
sons. This is a very intensive effort. It involves probably 4 or 5 
days of the firm, several of their top IT or product development 
specialists. It is a big imposition on a firm to undergo an FDA 
audit. This was strictly a voluntary activity. We had to express it 
to the firms as voluntary. That was the condition under which we 
did it. 

Many of the smaller firms may have a number of things going 
on that would mean it was not opportune for them at the time we 
needed to actually conduct the survey. Several of them had said not 
right now, but come back in a month and we will be glad to do it. 
We, of course, had the goal of getting the survey done promptly. 
That was one of the reasons. 

There is no suspicion that the firms are attempting to hide some- 
thing. 

Mr. Everett. You are a regulatory agency. Why aren’t they re- 
sponsive to you? 

Mr. Hubbard. Mr. Chairman, these audits were done voluntarily 
by contractors to FDA. They were not done by FDA investigators. 
If we believe there is any issue of safety or any concerns, and this 
one foreign blood transfusion software firm I mentioned may be one 
like that, we can send in an FDA investigator who can compel 
entry and eisk these questions. We have not seen the need to do 
that yet, but we clearly can and will do that if we believe there is 
any risk to human health from these products. 

Mr. Everett. For the record, this chairman would like to see 
those names listed. 

Mr. Hubbard. We will be glad to talk to the committee in more 
detail about those. 

Mr. Everett. According to GAO testimony, FDA was supposed 
to submit the final report to HHS by 1 October. It has not occurred. 
Further, there is no revised deadline. When will this report be sub- 
mitted to HHS? And I would like to know when this information 
will be made available to the public. 

Mr. Hubbard. There were delays that I will characterize as 
about a 2-week or so delay because many of the audits were being 
done in August when the key people were on vacation, and there 
were other difficulties. But we believe we will have a final report 
on this out by the first of November. 

Mr. Everett. I understand GAO’s testimony has given highest 
priority to 225 firms that produce devices that are only manufac- 
tured by a handful of these firms as well as 57 manufacturers that 
are sole source suppliers. According to an FDA senior associate 
commissioner, to date 197 of the high priority firms have responded 
and 48 of the 57 sole source firms have responded. As of October 
25, 1999, FDA had not responded to our request as to whether it 
plans to make a detailed survey and audit results from consumer 
medical product manufacturers available to the public. When do 
you plan to make these results pubHc? 
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Dr. Shope. We are currently working on a report that summa- 
rizes the results of our survey of the manufacturers of essential 
medical supplies, which is what you were referring to there. The 
225 firms that are one of the few makers of a product or the 57 
that are the sole source manufacturers of an essential supply. The 
report will describe an assessment of essential medical devices 
manufacturers and their manufacturing capability, not that they 
are computerized products that may have problems. It is the manu- 
facturing process and the preparation to continue to deliver sup- 
plies that is being addressed. 

We have a very high response rate from this survey. The remain- 
ing activity that we are doing right now is contmuing to follow up 
with audits by telephone and in a few cases on-site audits with our 
contractor to verify the results of the paper survey that we got 
fi'om manufacturers. We are currently drafting our report. The re- 
sults, I think, are good. 

The manufacturers have done a good job of planning for and de- 
veloping contingency plans. Over 80 percent of the firms are telling 
us that they are going to be ready by this time of the year. The 
remainder are indicating that they will be ready by December 31. 
There are a few firms that we haven’t heard from. We are cur- 
rently looking at who those firms are, what kind of products they 
make, and are they really essential supplies, and if there are any 
firms that remain on the fist that need action, we will follow up 
with those firms individually between now and the end of the year. 

Mr. Everett. Thank you very much for that detailed analysis. 
Doctor. The question is, when will you make this available to the 
public? 

Dr. Shore. We are working as heird as we can on getting this re- 
port out. I think in a matter of a couple of weeks we will have the 
report to describe to the public the results of these surveys. We 
have talked about it publicly already in terms of the general 
trends. 

Mr. Everett. Would you please give me a date? 

Dr. Shore. November 15. 

Mr. Everett. Thank you very much. Ms. Brown. 

Ms. Brown. You probably need to think a little bit about that 
date, because the Chairmaui is going to hold you to it. 

Mr. Hubbard. I am sure he will, and we will take that seriously. 

Ms. Brown. Your agency has really come a long way since this 
subcommittee began examining the readiness of the health care in- 
dustry for the year 2000. What lessons have you learned and what 
system improvement have you made as a result of the Y2K readi- 
ness efforts? 

Dr. Shore. I think the biggest lesson we have learned comes 
from the results of our survey of the 80 firms, the independent au- 
dits that were done by the contractor, which were an independent 
assessment of how is the quality approach to medical device design 
and manufacturing working in the country. We had a very high 
level of confidence at FDA about that system. 

As you will recall, we were not real enthusiastic about undertak- 
ing this effort, thinking that the companies were doing a good job. 
From the survey results, from the sample that we have looked at, 
this survey has told us from an independent side that the manufac- 
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turers do rigorously follow the quality system reg. So I think that 
gives us some increased degree of confidence on the seriousness 
with which manufacturers undertake their responsibilities with re- 
gard to medical devices. 

In terms of other lessons that we have learned, certainly our reg- 
istration and listing database system which is the system we use 
to know who is making what, we are in the middle of a re-engi- 
neering of that activity. I think we have seen some shortcomings 
there in terms of the currency and the accuracy of the data. It gets 
into some of the issues we have had: Is that firm still in business 
or not? Can we locate them? Those kinds of questions. We are look- 
ing at a re-en^neering process currently under way now to address 
some of those issues. 

I think those are the two that I take away from this. 

Ms. Brown. Thank you, Mr. Chairman. 

Mr. Everett. Mr. Udall. 

Mr. Udall. Thank you, and thank you for being here with us 
today. You express a high degree of confidence in assuring every- 
one that medical devices will be safe and drug supplies adequate 
on January 1. GAO is not so confident. They say that your clear- 
inghouse information is insufficient and sometimes inaccurate. 
With regard to accuracy, I am specifically referring to GAO’s analy- 
sis of biomedical equipment compliance status information. That 
differs from what you posted on the Internet. How do you respond 
to GAO’s vote of no confidence in FDA’s public information? 

Dr. Shore. We have looked diligently at any report we have re- 
ceived with any kind of detail or specificity about discrepancies be- 
tween manufacturers’ information and what a health care facility 
might have uncovered. We have, to date, really found no significant 
issues in those regards. There have been a few minor differences 
between performance noted in ways that have really no impact at 
all on patient health and safety. 

I think the database that we have provided to the industry, that 
is, the health care facilities who have the equipment in front of 
them and who want a specific answer about a piece of equipment 
they are very familiar with, the database does provide sufficient in- 
formation to allow them to do what they need to do to assess their 
products. 

The database was not originally designed to answer general 
kinds of questions in a way for people who are not familiar with 
the particular specific medical device. We have heard from health 
care facilities that the web site is a valuable, useful and helpful ac- 
tivity. We have not heard from any health care facility that there 
is insufficient data there, t^at they cannot get what they need from 
the database or from the memufacturers. 

I have only heard of one or two manufacturers that have not 
been real forthcoming in information about devices. I have to say 
those manufacturers are well known to us and their products are 
not the t 5 q)e that are the critical type products, and we are continu- 
ing to keep on eye on those couple of manufacturers. 

I think I basically disagree with the GAO’s conclusions. 

Mr. Udall. Who are those two manufacturers? 

Dr. Shore. One of the companies is a manufacturer of a nuclear 
medicine gamma camera type product, and I think the other is a 
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company that is now out of business actually. There are still some 
of their products out there. 

Mr. Udall. What are the names of the companies? 

Dr. Shopb. One company is Trionics and the other is Park 
Medical. 

Mr. Udall. Thank you very much. 

I yield back my time, Mr. Chairman. 

Mr. Everett. Thank you very much. 

Let me thank this panel. We have had some very candid con- 
versations over the last couple of years. I appreciate the fact that 
you recognize that this subcommittee has a great responsibility as 
well as FDA having a great responsibility. I appreciate the coopera- 
tion you have given us. I can assure you that I feel that although 
we have had some candid conversations, the results have been very 
beneficial to the American people and particularly our veterans. 

I would like to dismiss this panel now with my thanks. 

We will have two votes on the floor. That normally means about 
20 or 25 minutes. I will recess the hearing until that time. 

{Recess.] 

Mr. Everett. I would like to recognize now the Honorable 
Hershel Gober, Deputy Secretary of the Department of Veterans 
Affairs. Mr. Deputy Secretary, if you will please introduce your 
staff. 

STATEMENT OF HON. HERSHEL W. GOBER, DEPUTY SEC- 
RETARY OF VETERANS AFFAIRS, DEPARTMENT OF VETER- 
ANS AFFAIRS, ACCOMPANIED BY BL\ROLD F. GRACEY, JR., 
PRINCIPAL DEPUTY ASSISTANT SECRETARY FOR INFORMA- 
TION TECHNOLOGY; ERNESTO D. CASTOR, VA YEAR 2000 
PROGRAM MANAGER; LEONARD R. BOURGET, DIRECTOR, IT 
POLICY AND PLANNING STAFF, CHIEF INFORMATION OF- 
FICE, VETERANS HEALTH ADMINISTRATION; SALLY L. WAL- 
LACE, DIRECTOR, SYSTEMS DEVELOPMENT STAFF AND 
YEAR 2000 PROGRAM MANAGER, VETERANS BENEFITS AD- 
MINISTRATION; MARK DUROCHER, DIRECTOR, INFORMA- 
TION SYSTEMS SERVICE, NATIONAL CEMETERY ADMINIS- 
TRATION; AND STEVE WEXLER 

Mr. Gober. Thank you, Mr. Chairman. I have with me Mr. Har- 
old Gracey, who is our acting CIO and who has led the team get- 
ting ready for Y2K. I have Ernesto Castro, Sally Wallace, Len 
Bourget, Mark Durocher, and Steve Wexler. These are the folks 
that have been working on the Y2K issue. 

Mr. Everett. If you will, please begin your statement. Please 
limit the oral statement to 5 minutes, and your entire statement 
will be made a part of the record. 

Mr. Gober. Thank you, Mr. Chairman. I have a written state- 
ment I would like to have submitted for the record. 

Mr. Everett. Without objection. 

Mr. Gober. I am pleased to appear before this committee. I want 
to thank you, Mr. Chairman, from our meeting in 1996 when we 
started the Y2K effort. At that time I pledged to you I would stay 
engaged on this issue and that I was the person that was respon- 
sible for it, and I still maintain that today. 



19 


I know that you have other business to do, so with your permis- 
sion, I am going to make very, very brief remarks so that will leave 
maximum time for you to ask tiie questions that you need to ask. 
I would ask that, as we did in the last hearing, that my associates 
be permitted to ai^wer those questions that are technical and fall 
within their realm. 

Mr. Everett. Without objection. 

Mr. Gober. I am here simply today to reaffirm that benefits pay- 
ments will be made without interruption and our health care facili- 
ties will be operational on January 1 of the year 2000. 

I am also aware that Murphy’s Law will be in operation, and I 
have full confidence that the VA team will be ready to work 
through those unpredictable issues that may arise. We know that 
veterans and their families are depending upon us, and we shall 
not fail them. 

Mr. Chairman, this concludes my remarks, and we will be happy 
to respond to your questions. 

[The prepared statement of Mr. Gober appears on p. 88.] 

Mr. Everett. Thank you very much. Let me refer back to our 
meeting in 1996 when we both realized what an important issue 
this would be government-wide. I appreciate your commitment to 
the committee to make sure that the VA was ready and that our 
veterans would be able to depend on the VA. I congratulate you 
and your staff for the work that you have done. 

You have spid in your brief opening statement that the com- 
pensation and pension checks would be on time in January. We are 
very thankful for that. Will they be able to count on their VA medi- 
cal care? 

Mr. Gober. Yes, sir. We can go into as much detail on the testing 
that we have done and we will be glad to respond to that. But, yes, 
I feel confident that we will be able to deliver the health care to 
the veterans at midnight on December 31. I will not tell you that 
something will not go wrong, because every day in hospitals we 
have operational events arise. Even as we are speaking right now 
something may be going wrong, but we are prepared to take the 
necessary action to put it back into operation. 

I do feel that our veterans will not be threatened, health care 
will be provided, and the benefits checks will be delivered. Of 
course, as you know, we are delivering the benefits earlier, as we 
always do. They will be there on the 30th. We have tested the sys- 
tem through the Treasury and run the programs and they have 
worked. So I do feel confident. 

Mr. Everett. How about the department’s mission critical sys- 
tems compliance? 

Mr. Gober. I think I will let Harold answer that. 

Mr. Gracey. As we stated the last time we were here, we have 
made all our mission critical systems compliant. We have contin- 
ued to test them. In addition, we put in the moratorium that was 
mentioned earlier this morning to prevent problems fi-om being in- 
troduced into the system during the period from October 15 
through March. So we are very confident about the mission critical 
systems, and have been. 
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Mr. Everett. Mr. Deputy Secretary, what does day one rollover 
mean to the department? What still needs to be done for VA to be 
ready for day one? 

Mr. Gober. Ernesto. 

Mr. Castro. I can answer that. What day one refers to is the 
preparations for the actual date rollover, which is the last week of 
December and the first week of January. What we are doing there 
is making sure we have the process in place and the senior man- 
agers available for contact throughout the country. We will be 
working basically 24 hours, 7 days a week at the hospitals and co- 
ordinatii^ the monitoring for the Department and providing this 
information to the White House Information Coordination Center, 
which in turn will be notifying the Congress of the status of not 
just VA, but the rest of the world. 

Mr. Everett. Mr. Deputy Secretary, do you feel Y2K compliance 
in the area of VA research is compile or still needs to be done in 
the research arena? 

Mr. Bourget. If I may, Mr. Chairman. The research program 
has been dealt with in two ways, programmatically from head- 
quarters and the second through the medical center management 
chain. Each medical center director has been assigned responsibil- 
ity for ensuring that the research program has done its compliance 
work and is now doing contingency planning work. We have certifi- 
cations from the medical center directors and the VISN directors 
that that research activity has been carried out. 

There are details still to be done. As GAO pointed out this morn- 
ing, we are not through. We are still working the issue. So there 
are things that remain, but I am confident that the medical center 
management will see those through to completion. 

Mr. Everett. How many hospitals have biomedical devices on 
loan from the hospital to the patients at home, and how many of 
these devices have been certified Y2K compliant? 

Mr. Bourget. The home health care programs and the prosthet- 
ics programs at the VA medical centers have examined the devices 
that we have placed in patient homes. They have developed check 
lists to go over the care of the patient in the home. They have as- 
sessed the threat to the patient in their home situation. They have 
done that with their current census, and they wiU revisit that clos- 
er to the rollover to ensure that patients in their home are not in 
danger, for example, from failure of electrical power. 

We have not found any risk in terms of the equipment that is 
placed in the home. The CTeater threat may be the environment of 
care that the patient will be in, in which case there are plans at 
the medical centers individually to bring patients back into the 
hospitals for the rollover where they will be guaranteed sustained 
electrical power. 

Mr. Everett. Mr. Deputy Secreta^, the IG has expressed con- 
cern that VHA has not routinely received certification of the contin- 
ued use of non-compliant biomedical devices beyond December 31, 
1999. How many hospitals have emergency lighting and alternative 
cooking heat in the kitchen? During an emergency how can the 
hospital cook in the dark? 

Mr. Bourget. Each hospital has done a test of their emergency 
electrical generator, and where there were deficiencies, for exam- 
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pie, a kitchen in the dark, those deficiencies should have been rem- 
edied by now. I will certainly go back and check on that in particu- 
lar, Mr. Chairman. 

There were deficiencies when they ran the test. There were prob- 
lems. For example, one hospital found all of its elevators were on 
emergency power but none of the elevators had lights. The cabin 
lights were on a different circuit. They have now fixed that 
problem. 

Another hospital found that its command center, which would be 
operational over the rollover, was not under emergency power. 
That has been remedied. 

There have been many learning opportunities from the emer- 
gency electric generator test, and those deficiencies that were found 
are fong corrected. 

Mr. Everett. I am told by staff that some hospitals tested their 
generators for about 8 hours; others as little as 30 minutes. 

Mr, Bourget. The recommendation, sir, was that they all test 
for 8 hours. 

Mr. Everett. Have they all tested for 8 hours? 

Mr. Bourget. No, sir. Some did conduct shorter tests. 

Mr. Everett. Thirty minutes or less? 

Mr. Bourget. That I have not heard. That is news to me, sir. 
I will certainly pursue that with your staff. 

Mr. Everett. Ms. Brown. 

Ms. Brown. In August of 1999, after concurring with the audi- 
tor’s findings and providing appropriate actions to implement the 
recommendations, Mr. Gracey, the Acting Assistant Secretary for 
Information Technology, requested additional IG assistance to help 
assess his Y2K implementation efforts. I like that kind of attitude, 
Mr. Gracey. 

Mr. Gracey. Thank you. 

Ms. Brown. How will VA handle the rollover from a staffing per- 
spective? Can you give us more details? 

Mr. Gracey. Yes, ma’am, I would be glad to. We have a plan to 
activate several sites around the country specifically for the week- 
end period, Friday night, the 31st, and the morning of the 1st, al- 
though there will be staff there longer. 

Myself and a number of other senior staff will be at Martinsburg, 
WV, which is our normal emergency management center, where we 
will be collocated with the Veterans Health Administration’s man- 
agement. Veterans Benefits Administration will be at an emer- 
gency center at 1800 G Street. Ernesto is going to be in the White 
House Information Coordination Center, which is also located at 
1800 G Street contiguous to our space. National Cemetery Admin- 
istration will do the same. Public Affairs will do the same. 

We have made arrangements to be in contact with each other 
and also with everyone else who is a significant organization by a 
variety of means of communication. We think we are set up in a 
mode where we will be able to react to whatever happens during 
that period. 

Ms. Brown. Thank you. I have one other thing, Mr. Gracey. In 
a letter I submitted for the record during my opening statement 
the VA Inspector General was very complimentary of your efforts 
to bring the department into Y2K compliance. He, however, identi- 
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fied six areas of concern. I want to go through a few of them in 
the time that we have, and then I would like to submit the others 
for follow-up questions. 

Some VA locations have some contingency plans that were not 
customized to address individual facility plans. How has this been 
addressed? 

Mr. Gracey. We followed up. That was the Veterans Health Ad- 
ministration side where they appeared to have done a skimpy job 
or resubmitted the template. Those plans have been redone, and to 
the best of my knowledge they are all now complete as of the latest 
version. 

Mr. Bourget. Yes, that is correct. Further, we developed a check 
list for reviewing contingency planning. We made site visits to 13 
medical centers and reviewed their planning process and their 
plans, and then we gave those check lists to the VISN directors and 
encouraged them to go out to the hospitals that we were imable to 
visit and to do an on-site review of contingency planning at each 
medical center. 

Ms. Brown. IG has been advised that some of the buildings 
leased by VA from General Services Administration are still not 
Y2K compliant. What is VA’s risk and what is being done to protect 
the department and its customers in these buildings? 

Mr. Gracey. We are down now to only one GSA leased building 
that has not been certified compliant. That happens to be the VA 
regional office in Washington, DC. We are expecting advice from 
GSA later this week on exactly what the status of that building is, 
and we expect to have that resolved sometime in the next 63 days. 
All the rest, including the out-based sites, are associated with 
buildings that have been certified compliant or that we have made 
compliant. So we are very comfortable with that. 

Ms. Brown. I really want to thank you all for being the leader 
in this area. Not just showing that VA can do a good job, but being 
the leader as far as other agencies are concerned. This will be ex- 
tremely important to the veterans and their families with the un- 
certainties in the country. So thank you again. 

Mr. Chairman, I yield back my time. 

Mr. Everett. I thank the gentlelady. 

I have a couple of other questions. Why haven’t all the hospitals 
in the field used the Y2K VISTA data management software for 
biomedical devices provided by VACO? VISN 5 made good use of 
it and has provided the subcommittee with a detailed list of the 
Martinsburg VAMC biomedical equipment inventory. My under- 
standing is very few have done that. 

Mr. Bourget. Mr. Chairman, that was a tool that we developed 
during the past 2 years to assist the hospitals based on an inven- 
tory system that they are using. The specific Y2K tool that we de- 
veloped enabled them to process Y2K compliance issues with the 
medical devices. Mr. Steve Wexler, our chief biomedical engineer, 
can perhaps address why not all facilities may have availed them- 
selves of that tool. 

Mr. Wexler. What you are looking at is an existing system that 
has been put in place in all VHA hospitals to track critical medical 
equipment from basically its infancy through when it is turned in. 
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All medical centers, as you may know, are periodically reviewed 
by the Joint Commission on Accreditation for Healthcare Organiza- 
tions. One of the things the JCAHO inspectors look for is an inven- 
tory listing of medical devices that are tracked for critical mainte- 
nance activities and for hazards and recalls. 

Actually it has been in place since 1985. For all our facihties that 
have been reviewed by the Joint Commission on Accreditation for 
Healthcare it has never been pointed out as a deficiency to us. 

Mr. Everett. How many actually use the system? 

Mr. Wexler. To my knowledge, they all do. 

Mr. Everett. I will have to tell you that that is not the sub- 
committee’s information. I would like clarification on that. 

In addition to being ready for Y2K, have there been other lessons 
learned to improve preparedness and experience gained in the 
areas of VA’s disaster and emergency relief missions? We have 
gone through extensive work here, and I am sure there have been 
some side benefits. 

Mr. Gober. I think it has been very useful, Mr. Chairman. All 
the hospitals now have a contingency plan. It has helped us in our 
other contingency planning for natural disasters and other emer- 
gency events. So I think it has been a good event. 

I want to thank you also for your efforts and Ms. Brown’s efforts 
and the members of your staff for helping us. They have been very 
helpful to us when they go visit. We cannot visit all the hospitals, 
but when the staff goes out and visits, they do bring these situa- 
tions to our attention and we immediately take corrective action. 

As we were talking earlier, I think we have picked all the low 
h^ging fmit now, and we are going to continue to reach for the 
higher fruit to not see this as a negative aspect. I think Y2K has 
been a very, very positive experience for us. That’s why I can sit 
here and say that I feel reasonably confident that we are going to 
be okay. 

So I think, yes, it has been a very positive experience and it has 
helped the VA. 

Mr. Everett. I want to thank the panel and you, Mr. Deputy 
Secretary. At this point I would like to yield to Ms. Brown for her 
closing statements, and then I will have a closing statement, 

Ms. Brown. Thank you, Mr. Chairman. I am proud of the work 
that this subcommittee has done over the past 2 years. In large 
part because of your efforts and some heavy lifting by the General 
Accounting Office, VA is now considered a leader in the Y2K prepa- 
ration. But more importantly, through your leadership, America’s 
veterans and their families have had the VA benefits and services, 
upon which they depend, inoculated against the worst effects of the 
feared Y2K bug. Now, even if VA’s computers become infected 
through their interaction with “other children in the neighbor,” I 
think the department would get but a mild case of the “glitches.” 

I am confident, also, that the prognosis would be good for a quick 
and fiill recovery. 

Thank you. 

Mr. Everett. I thank the gentlelady. It is apparent to this sub- 
committee that the VA has made a tremendous effort over the past 
3 years addressing and correcting Y2K problems that could have 
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severely disrupted critical benefit delivery and health care services 
to America’s veterans. 

Mr. Gober, I applaud you as Deputy Secretary of Veterans Af- 
fairs and the VA’s chief operating officer for leading the charge, 
mobilizing the troops, and averting what had the potential to be a 
great disaster. I think veterans can breathe a lot easier about re- 
ceiving their benefits on time and getting safe health care and 
using life saving medical devices that will not fail them, as well as 
not being deprived of prescriptions and medical supplies that they 
need in their daily lives. 

I will have to say that considering the complexity of the VA — and 
we all know it is a very complex system — in my opinion the VA is 
above all other government agencies in reaching Y2K compliance. 

This has been one of the most difficult management challenges 
to face government since World War II. You all and all the VA em- 
ployees, including the Office of the Inspector General, have met the 
challenge most impressively. The success of this effort is proof posi- 
tive that when this department puts its will to solving a difficult 
problem, it can do the job. 

I look forward to seeing this kind of success replicated in other 
challenges the VA faces. I know you do not intend to rest on these 
accomplishments, because the VA must continue its diligence in 
testing and refining business and contingency plans and day one 
plans. 

I have no doubt that somewhere, somehow, despite all the best 
efforts, some, hopefully minor, Y2K problems will likely occur on 
January 1, 2000, and the VA must be fully prepared to deal with 
them effectively. That means being fully prepared for the worst 
case scenario. 

I would like to thank the GAO again for its tremendous effort 
and contributions in analyzing both the potential problems facing 
the VA and the FDA and the effectiveness of these efforts to over- 
come them. GAO has performed a highly significant public service 
for the VA, FDA, veterans, and all Americans. 

I also want to acknowledge the efforts of the FDA. Since our last 
hearing in April, FDA has addressed many of the concerns that 
were raised in that hearing. I urge FDA to continue moving for- 
ward aggressively to complete its evaluation of Y2K compliance in 
the pharmaceutical and biomedical devices industry. The American 
public needs to be informed and has every right to know if any 
medical products could put them at risk, and if the public is to be 
confident about the supply of vital medications, it must be con- 
fident of the information available to them. 

I truly hope the new year will prove to be imeventful for our vet- 
erans in terms of computers. It is simply amazing how reliant we 
have become on those dam machines in the last few years. 

I would also like to congratulate my Ranking Member for her in- 
terest in this and sticking with us and asking the tough questions 
when they needed to be asked. 

This hearing is adjourned. 

[Whereupon at 11:38 a.m. the hearing was adjourned.] 
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Well, here we are again, Mr. Chairman, trying to reassure America’s 
veterans and their families that VA hospitals will operate normally on New Year’s 
morning, and that all checks will be delivered on time. 

Today it will be nice to hear VA report on how it is ready to roll over into 
the Year 2000, and how it received two “A’s” last month from a House oversight 
committee that was grading Y2K efforts government-wide. 

It also will be nice to hear the Food and Drug Administration say how much 
confidence it has that essential medical supplies will be available, that medical 
devices will function as intended, and that there will be a safe and adequate supply 
of drugs available. 

I am concerned, however, Mr. Chairman, that all of today’s nice talk will be 
meaningless if VA has to walk its walk in a community shut down by a massive 
power outage or in a town where the water supply has been cut off for a long 
period of time. 

Disruptions on a large scale would, of course, be beyond VA’s control. I am 
sure that VA will answer today’s pop quiz questions on this concern by saying that 
each of its facilities is individually planning for such contingencies. The real test, 
Mr. Chairman, on how well VA’s decentralized health care system has done its 
local plarming will not be given this morning. That test will start at 12:01 a.m. on 
Saturday, January 1, and continue through the 29“' of February. 

I appreciate the hard work and long hours that so many VA employees have 
already given in preparation for the Etepartment’s roll over to Year 2000. I 
especially appreciate the dedication of those who plan to give up their New Year’s 
holiday to ensure that America’s hospitalized veterans might celebrate the new 
milleimium in comfort and safety. To the Department of Veterans Affairs and all 
those it serves, I wish you a smooth conversion and an uneventful New Year. 
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Mr. Chairman, I know that the General Accoimting Office has some 
continuing concerns. As we hold this fifth in a series of Y2K hearings, I appreciate 
the diligence of the GAO audit staff in keeping VA’s and the FDA’s feet to the fire 
over the past two years. 

VA’s Inspector General also has been active in assisting the Department’s 
Y2K implementation efforts fi-om the beginning. Inspector General Richard 
Griffin is not testifying today, Mr. Chairman, but I would ask that his letter to me 
dated October 25, 1999, outlining the work of his office in this matter, be made a 
part of the record. 

A June 1999 Office of Inspector General audit found that VA’s Y2K efforts 
were well organized and focused on those mission critical systems that must be 
compliant to ensure that veterans receive uninterrupted services. VA reported to 
the Inspector General that it has successfully completed implementation of all 
mission critical systems and is now engaged in completion of necessary 
contingency platming actions. 

The Inspector General’s June audit identified areas where VA’s Y2K 
implementation efforts could be strengthened. VA concurred with both the audit 
findings and recorrunendations, and has provided appropriate implementation 
actions. In August 1999, the Acting Assistant Secretary for Information and 
Technology requested additional IG assistance to further assess Y2K 
implementation efforts. I like that kind of attitude. 

Mr. Chairman, I am proud of the work that this Subcommittee has done over 
the past two years in first sounding the clarion call to readiness and then sticking 
doggedly to the daunting challenge of making the Federal government’s second 
largest agency Y2K compliant. 

Mr. Chairman, in large part because of your efforts — and some heavy lifting 
by the General Accounting Office -- VA now is considered a leader in Y2K 
Federal preparedness. But more importantly, through your leadership, America’s 
veterans and their families have had the VA benefits and services, upon which they 
depend, inoculated against the worst effects of the feared Y2K bug. Now, even if 
VA’s computers become infected through their interaction with the “other children 
in the neighborhood”, I think the Department would get but a mild case of the 
“glitches”. I am confident, also, that the prognosis would be good for a quick and 
full recovery. 
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Statement of Joel C. Willemssen, Director, Civil Agencies Information 
Systems, Accounting and Information Management Division, United States 
General Accounting Office 

Mr. Chairman and Members of the Subcommittee: 

Thank you for inviting us to participate in today’s hearing on the Department of Veterans 
Affairs’ (VA) efforts to address the Year 2000 (Y2K) computer problem.' My testimony 
today will focus on the Y2K readiness of automated systems that support the delivery of 
veterans’ benefits and health care services, the compliance status of biomedical 
equipment used in patient care, and the Y2K readiness of the pharmaceutical and 
medical-surgical manufacturers on which VA relies. I will also share with you 
information on the Food and Drug Administration’s (FDA) Y2K efforts to address 
biomedical equipment and pharmaceutical products.^ 


In brief, VA continues to make progress in addressing the Y2K problem. It has 
established a moratorium on software changes and has developed a Day One plan to 
minimize risks associated with the rollover period. However, some critical tasks remain 
to be completed. For example, only about 10 percent of the Veterans Benefits 
Administration’s (VBA) 58 regional offices have tested their business continuity 
and contingency plans. And, inaccuracies in monthly reports submitted by the Veterans 
Health Administration’s (VHA) medical facilities make it difficult to determine their 
progress in renovating facility systems, telecommunications systems, commercial-off- 
the-shelf (COTS) software, computer platforms, and medical devices. Further, VHA has 


' As is widely known by now, for the past several decades computer systems have often used two digits to 
represent the year, such as *D8” for iS^8, in order to console electronic data storage and reduce operating 
costs. In this format, however, 2000 is indistinguishable from 1900 because both are represented as **00." 
As a result, if not modified, systems or applications that use dates or perform date- or time-sensitive 
calculations may generate incorrect results beyond 1999. 

* Biomedical equipment refers to both medical devices regulated by FDA, within the Department of Health 
and Human Services, and scientific and research instruments, which are not subject to FDA regulation. 
Pharmaceutical products also fall under FDA’s regulatory authority. 
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not implemented our prior recommendation to review the test results for biomedical 
equipment used in critical carertife support environments. It is crucial that VA address 
these issues if the department is to continue to reliably deliver benefits and other health 
care services through the turn of the century. 

FDA, for its part, has made progress in making compliance information on biomedical 
equipment available to users through its Feilera! Y2K Biomedical Equipment 
Clearinghouse. It is also conducting surveys to determine the Y2K readiness of 
pharmaceutical, biological, and consumable medical^ products manufacturers. FDA has 
also recently addressed our concern about the lack of independent verification and 
validation of critical care/life support biomedical equipment certified compliant by 
manufacturers. Specifically, it has reviewed a sample of these manufacturers’ Y2K 
acbvities, including risk management, test planning and procedures, implementation, and 
contingency planning. In the limited time remaining, FDA still needs to issue its final 
report to the Department of Health and Human Services (HHS) summarizing the results 
of its review of manufacturers’ Y2K activities and make these results available to the 
public. 

VA IS MAKING PROGRESS ON SYSTEMS BUT CRITICAL TASKS REMAIN 

Like many organizations, VA faces the possibility of computer systems failures at the 
turn of the century due to incorrect information processing relating to dates. This could 

^ Consumable medical products are expendable, disposable, or non^durable supplies used for the treatment 
or diagnosis of a patient's specific illness, injury, or condition. Examples include surgical gloves and 
intravenous tubing. 
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make veterans who are eligible for benefits and medical care appear ineligible. If this 
happens, the issuance of benefits and the provision of medical care that veterans rely on 
could be delayed or interrupted. 

At your request, Mr. Chairman, we have been monitoring and evaluating VA’s actions to 
address the Y2K problem since 1996.'* We have also made many recommendations to 
reduce the risk associated with Y2K failures, and VA has been responsive to these 
recommendations. For example, VBA changed its strategy from relying on new Y2K- 
compliant systems to fixing the current systems in order to address the risk that the new 
systems would not be completed in time. In 1998, VBA also reassessed its mission- 
critical efforts for the compensation and pension on-line application and the Beneficiary 
Identification and Record Locator Sub-System, as well as other technology initiatives to 
help ensure that these critical undertakings were completed in time. Simultaneously, 
VHA issued its Patient-Focused Year 2000 Contingency Planning Guidebook to its 
medical facilities, describing actions they could take to minimize Y2K-related disruptions 
to patient care. More recently, both VBA and VHA developed business continuity and 
contingency plans that address mission-critical systems, core business processes, regional 
offices, and medical facilities. 


* See Year 2000 Computing Crisis: Actions Needed to Ensure Continued Delivery of Veterans Benefits and 
Health Care Services (GAO/AIMD-99-190R, June 11. 1999), Year 2000 Computing Crisis: Action Needed 
to Ensure Continued Delivery of Veterans Benefits and Health Care Services (GAO/T-AIMD-99-136, 

April 15, 1999). Year 2000 Computing Crisis: Compliance Status of Many Biomedical Equipment Items 
Still Unknown (GAO/AIMD-98-240, September 18. 1998). Year 2000 Computing Crisis: Progress Made in 
Compliance ofVA Systems, But Concerns Remain (GACWAIMD-98-237, August 21, 1998), Veterans 
Affairs Computer Systems: Action Underway Yet Much Work Remains to Resolve Year 2000 Crisis 
(GAO/T-AIMD-97-174, September 25. 1997). Veterans Ben^ts Computer Systems: Risks of VBA's Year- 
2000 Efforts (GAO/AIMD-97-79, May 30, 1997), and Veterans Ben^ts Modernization: Management and 
Technical Weaknesses Must Be Overcome If Modernization Is To Succeed (GAO/T-AIMD-96-103). 
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In addition, VA has reported to the Office of Management and Budget (0MB) that it 
completed renovating and implementing the ntission-critical applications supporting its 
11 systems are^ as of March 31, 1999. As shown in table 1, VBA has six of these areas, 
and VHA has two. 

Table I; Reported Status of VA*s Mission-Critical Computer Systems Areas and Their 
Ai^lications 


Component/Office 
(Number of svstems) 

Systems Area 

Number of An>lications 

Renovated or Replaced 

\’eleran^ Beneftls 

Compensation and Pension 

30 

Adminiionnion (6) 




Education 

24 


Insurance 

3 


Loan Guaranty 

19 


Vociuionai Rehabilitation 

4 


Administrative 

27 


Toul 

107 

Veterans Health Administration 

Veterans Healdi Information 


(2) 

Systems and Technology 



^chitecture 

105 


Veterans Health Administration 



Corporate Systems 

95 


Tout 

200 

National Cemetery 

Buriid Openttfons Support 


Administration (1) 

SyslenVAutomated Momimem 



Application System 

1 


Reengineer 

' 


Toul 

2 

Office of Financial Management 

Personnel and Accouming 


(2) 

Integrated ^u 

8 


Financial Man^ment System 

1 


Tool 

9 

VA Total 


air 


Source: VA. We have not independently verified this information. 
"Of this tout. 316 applications were renovated and two were replaced. 
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Although VA has made progress, when we testified* this past April, the department still 
had numerous Y2K issues to address. Specifically, (1) VBA and VHA had not 
completed testing of their mission-critical systems to ensure that they could reliably 
accept future dates, (2) VHA had not completed assessments of its facility systems,* (3) 
VHA’s pharmaceutical operations were at risk because the automated systems supporting 
its consolidated mail outpatient phannacies (CMOP) were not Y2K compliant, (4) VHA 
had not defined the CMOP systems as mission-critical in its quarterly report to 0MB, and 
(S) VHA did not know whether its medical facilities would have a sufficient supply of 
phamiaceutical and medical/surgical supplies on hand because it did not have complete 
information on the Y2K readiness of these manufacturers. To address these issues, we 
made the following recommendations to the Secretary of Veterans Affairs:’ 

• complete Y2K testing of VBA and VHA mission-critical systems — including systems 
acceptance testing,* full forward-date testing,* end-to-end testing, and business 
process simulation testing on compliant platforms; 

• set deadlines to complete assessment, renovation, validation, and implementation of 
VHA’s facility systems; 

• develop business continuity and contingency plans for VHA CMOPs to ensure an 
uninterrupted supply of medications to veterans in the event of Y2K problems at 
these facilities; 


’ GAO/T-AIMD-99-136, April 15. 1999. 

* Facility systemb include building-related equipment such as elevators, heating, ventilating, and air 
condHKmmg equtpmem, lighting systems, security systems, and disaster recovery systems. 

’ GAO/AIMD-99-190R. June II, 1999. 

* Systems accepuincc testing verifies that the complete system — the full component of applications 
software running on the target hardware and system software — satisfies specific requirements and is 
acceptable to users. 

^ Forward-date testing verifies that the system is able to process using future dates in 2000 and beyond. 
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• reassess VA’s decision not to leport CMOP systems as mission-critical; and 

• seek the assistance of FDA and industry trade associations in obtaining infoimation 
on dte Y2K readiness of specific pharmaceutical and medical/sur^cal suK>liers'* that 
did not respond to VHA’s survey, and publicize the results in a single data 
clearinghouse. 

VA Has Been Responsive to Recommendations 

VA generally agreed with our recommendations, and actions to implement them have 
either been taken or are underway. 

• Both VBA and VHA have completed systems acceptance and forward-date testing. 
VBA completed systems acceptance testing of its benefits delivery applications and 
also tested its payment systems' ability to process benefits in January 2000, in 
conjunction with the Department of the Treasury's Financial Management Service 
and the Federal Reserve System. This testing was completed in July 1999. Likewise, 
VHA completed Y2K systems acceptance testing of its mission-critical hospital 
systems. In addition, in August 1999, VHA's independent verification and validation 
test group forward-date tested S6 hospital applications." 

« VHA issued a policy directive on July 30, 1999, stating that its medical facilities had 
to make a decision on renovation strategies by September 1, 1999, for those facility 
systems components and interfaces whose Y2K status was noncompliam, 
conditionally compliant, or unknown. The directive also required these facilities to 

These include manufacturers and distributors. 

" These 56 applications, which run at most VA health facilities, were chosen for their dale iniensiveness 
and business criticality. Included among the applications tested were inpatient and outpatient pharmacy, 
radiology, laboratory, and surgery. 
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establish specific contingency plans for each of these systems. According to the Y2K 
project office, ait of the medical facilities have met this requirement. 

• VHA’s CMOPs have developed business continuity and contingency plans that 
address important issues such as the toss of electrical power, telecommunications 
with the medical centere, and their automated dispensing machines. These plans 
should reduce die risk that Y2K disruptions will impair the CMOPs' ability to 
continue filling and delivering veterans' prescriptions. 

• In its August 1999 report to OMB, VA said that renovation of the vendor-supplied 
CMOP dispensing systems were on schedule to make all seven CMOPs Y2K 
compliant by September 30, 1999. 

• VA has worked with FDA and various other industry associations to obtain and share 
Y2K-readiness information on the Y2K compliance status of pharmaceutical and 
medical-surgical manufacturers. It has posted results on its Internet home page 
fwww.va.govl . 

VA Established a Moratorium on Software Changes 

To minimize possible disruptions to agencies' Y2K readiness resulting from system 
changes, OMB, in a May 14, 1999, memorandum to heads of departments and agencies, 
requested that agencies establish a process to ensure that the effect on Y2K readiness is 
considered prior to establishing new requirements or changes to information technology 
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systems.'^ We had previously testified that agencies should institute such a process to 
ensure that software changes do not negatively affect Y2K readiness.” 

In response to OMB’s memorandum, VA issued a October 14, 1999, memorandum to 
department heads imposing a moratorium on implementing new systems, changes to 
existing systems, or third-party upgrades to VA’s information technology systems 
between October 15, 1999, and March 31. 2000. The intent of the memorandum was to 
ensure that the department incorporates Y2K change management procedures. It further 
stated that in those instances in which software changes were necessary — such as when 
compliant software had to be modified due to legislative or other agency requirements — 
it would be necessary to test all changes and recertify the software’s compliance.” 

VA has also defined a process for requesting waivers for software changes or upgrades 
during this time. Specifically, waivers must be justified by the VA administration 
requesting them and concurred with by that administration’s chief information officer 
(CIO), architecture review board, or senior information technology official. The request 
is then submitted to VA's Principal Deputy Assistant Secretary for Information and 
Technology for approval. 


'■ 0MB Meiiivraiulum M-99-I7: Minimizing R«guUuory and Information Technology Requirements that 
Could A^ct Progress Fixing the Year 2000 Problem, May 14. 1999. 

*^Year 2000 Computing Crisis: Readiness Improving, Bui Much Work Remains to Avoid Mofor Disruptions 
<GAO/T-AIMD-99*50, January 20. 1999). 

Examples of software that will be modified include applications affected by cost-of-living adjustments 
that usually take effect in January 
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Prior to the department’s issuing this moratorium, VBA had developed and issued a 
similar moratorium to all VBA offices on July 29, 1999. Hus memorandum imposed a 
moratorium on the deployment of new application changes or third party product 
upgrades between September 1, 1999, and April 1, 2000, and stated that exceptions to the 
moratorium included emergency fixes and legislatively mandated changes such as cost- 
of-living adjustments. 

VHA has not yet issued specific instructions on how it will implement the department’s 
moratotium. However, according to VHA’s Y2K project office, it plans to issue 
guidance to its offices and medical centers based on VA’s memorandum. According to 
VHA’s Y2K project manager, this guidance was not developed earlier because VHA was 
waiting for the department to issue its memorandum. 

VA Has Developed a Day One Strategy 

As we note in our business continuity and con;ingency planning guide,’’ developing a 
Day One risk reduction strategy and procedures for the period between late December 
1999 and early January 2000 is a key element in contingency planning. Earlier this 
month, we issued a more specific guide on Day One planning.” In addition, 0MB, on 
October 13, 1999, issued a memorandum to the heads of selected departments and 


Year 2000 Computing Crisis: Business Conlitutity and Contingency Planning (GAO/AIMD- 10. 1 . t9. 
AugunI 1998). 

yiK CifMipuiing Challenge: Day One Planning and Operations Guide <GAO/A1MD*10.1.22, Oct(^)er 
1999). 
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agencies” instructing them to develop Day One plans and encouraging them to use our 
guide in the development of these plans. OMB required that the plans address seven 
areas: (1) schedule of activity, (2) personnel on call or duty, (3) contractor availability, 
(4) workforce communication, (5) facilities and services to support workforce, (6) 
security, and (7) public communications. 

VA and its agencies have developed a high-level Day One strategy that should help the 
department manage risks associated with the January 1 rollover and better position it to 
address any potential disruptions. This strategy addresses each of the seven areas 
required by OMB: 

• a time line of events between December 31 and January 1; 

• a personnel strategy and leave policy that identifies key managerial and technical 
personnel available to support Day One operations; 

• a statement that its administrations reviewed vendor service agreements and revised 
them to ensure that contractor support and other needs for the rollover period are met; 

• a communications structure for workforce reporting during the rollover period. 

Under this structure, VBA regional offices plan to report to regional representatives, 
who plan to report to a national VBA information coordination center, located at 
VBA headquarters in Washington, D.C; VHA medical centers plan to report to their 
Veterans Information Service Network (VISN) '* representative, who plans to report 
to a national VHA information coordination center located in Martinsburg, West 

OMB Memorandum M-OO-OI: Day One Planning and Request for Updated Business Continuity and 
Contingency Plans, October 13, 19^. 

" Veterans Integrated Service Networks are 22 regional organizations encompassing medical centers, 
nursing homes, and domicitiaries. 
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Virginia. The VBA and VHA national information coordination centers plan to 
report to tte VA national information coordination cen^, also located in 
Martinsburg; 

• a statement that its facilities have addressed facility and support services for its 
workforce in their business continuity and contingency plans. In addition, the Day 
One plan requires regular “health" checks to ensure that these services remain 
available during the rollover period; 

• a statement that the VA computer systems and data centers are being secured and 
additional security has been extended to the networks to increase protection during 
the rollover period; and 

• a VA Office of Public Affairs information cortununications center to support the VA 
national information coordination center and direct public communications through 
the Joint Public Information Center that the President's Council on Year 2000 
Conversion Council plans to set up for the rollover period. 

VA’s Day One plan also describes preparation activities that VA has completed or plans 
to complete in order to help minimize potential Year 2000 disruptions to benefits delivery 
and health care. For example, VBA plans to process most of its regular, recurring 
benefits payments so that they will be available to veterans on December 30, 1999. This, 
according to the plan, will greatly mitigate possible Y2K interruptions of benefits 
payments. 
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VA Has Developed Business Continuity and Conlineencv Pians 

According to VA’s August 1999 report to OMB, its regional offices and medical facilities 
have completed business continuity and contingency plans. In addition, according to VA, 
a selected number of these plans have been reviewed by their respective Y2K project 
offices. Specifically, VBA’s Y2K project office reviewed the plans of its regional offices 
and found that they met VBA requirements. We reviewed 15 of the 58 VBA regional 
plans and found that they address resources, staff roles, procedures, and timetables for 
implementation, as well as risks and risk mitigation. 

In reviewing Ihe 58 medical facilities’ business continuity and contingency plans, VHA’s 
Y2K project office concluded that while overall the plans adequately addressed 
contingency planning, the plans of 14 facilities were deficient. These deficiencies 
included the lack of a schedule of critical events; lack of a policy statement describing the 
authority, responsibility, and procedures for Y2K contingency planning; and missing 
contingencies for specific functional areas, such as intensive care or operating rooms. 

The project office asked the 1 4 facilities to address these deficiencies and submit revised 
plans, which it is currently reviewing. 

We reviewed the plans of 29 medical facilities to determine their completeness,” and 
found that, in some cases, the schedule of critical events and execution timelines were not 
specific to the medical facility. Additional specificity, such as time lines relevant to the 

The plans chosen for review included 19 medical facilities in the three VlSNs that we have been 
monitoring, and four facilities that are collocated with a CMOP. 
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medical facility and specific dates for accomplishing tasks contained in the time lines, 
would help make it easier for facility staff to implement the plan, and help minimize 
confusion that might result if plans needed to be activated. A second issue concerned the 
lack of medical facility coordination with VHA’s seven CMOPs. This is especially 
important since the seven CMOPs supply about 50 percent of VA’s prescriptions to 
veterans. VHA’s guidance, however, only required sites that were co-located with a 
CMOP to comdinate their plans with that CMOP alone. 

We discussed these issues with representatives of VHA's Y2K project office. They 
agreed with our concern regarding the time lines and said that the sites had been advised 
to ensure that these were sufficiently specific. In addition, the VHA Y2K project 
manager told us that all CMOPs had been advised to discuss their business continuity and 
contingency plans with the medical facilities that they support so that they are aware of 
them. 

VA Has Not Completed Testing of Its Business 
Continuity and Contingency Plans 

Testing of business continuity and contingency plans is key to determining whether the 
contingencies are capable of providing the needed level of support to cote business 
functions and whether they can be implemented in a reasonable amount of time. In 


13 



40 


addition, testing can show where plans need to be updated or changed. We previously 
testified that testing of plans should be completed by September 30. 1999.^ 

As of October 22, 1999, only five of VBA’s 58 regional offices had completed testing of 
their business continuity and contingency plans. VBA initially asked that each regional 
office complete a “desktop” exercise^^ of its plan by September 30, 1999, during which 
the business continuity and contingency plan team and other critical staff would simulate 
an emer^ncy situation. According to VBA’s Y2K project manager, the project office is 
now requiring the regional offices to complete this exercise by November 15, 1999. It is 
critical that VBA regional offices test their plans to ensure that their contingencies are 
sufficient to maintain an acceptable level of service and that the contingencies can be 
implemented in a feasible time frame. 

All of VHA’s medical facilities reportedly have completed emergency drills. These 
drills, conducted under controlled conditions to ensure no impact on patient safety, 
required each facility to turn off its local electric supply and rely on backup generators. 
The medical facilities identified deficiencies in their plans as a result of these drills. For 
example, one site found that its generator was not capable of powering the entire hospital. 


“ GAO/T-AIMD-99-50, January 20. 1999. 

VBA's “desktop” simulation was not to include the actual establishment of an emergency operations 
center or emergency backup sites. 
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It has now contracted for an additional backup generator to ensure that all critical areas 
can be powered. Other sites found that some of their mission-critical areas were not 
linked to the backup generator, and have since contracted for additional work to link 
them. 

While VHA’s medical centers have tested their facilities' ability to handle power outages, 
other portions of their business continuity and contingency plans, such as dealing with 
potential water and gas shortages, have not been tested. Losses in these areas can have an 
impact on patient care. Specifically, a VHA medical facility recently suffered a loss of 
water, resulting in a loss of the steam plant, cooling towers, and fire suppression system. 
This facility suggested that other facilities reevaluate their contingencies in view of these 
losses. 

Monthly Reports Do Not Accurately Reflect 
Y2K Status of Noiicomnliant Systems 

All of VHA's VISNs/medical facilities are required to prepare monthly reports on their 
Y2K progress in assessing, renovating, validating, and implementing compliant systems. 
Specifically, they report on their Y2K status in six areas: locally developed software, 
COTS software, computer platforms, telecommunications systems, facility systems, and 
medical devices. These reports ate used by VHA to monitor progress in addressing Y2K 
issues and to identify problem areas. 
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VHA’s summary report for August 1999 indicated that the medical centers had made 
limited progress in renovating their remaining noncompliant facility systems and 
telecommunications systems. Specifically, it showed that overall, only 43 percent of the 
facility systems and 41 percent of the telecommunications systems at the medical 
facilities had completed renovation. The numbers were somewhat higher for COTS 
software, at 55 percent, and computer platfoims, at 65 percent. The highest renovation 
number was for locally developed software products, at 94 percent. We discussed these 
renovation statistics with VHA’s Y2K project manager, who told us that the summary 
report may not be accurate because facilities are not clear on whether to report on 
systems or on the components that make up the systems. 

During visits to selected medical facilities we confirmed thal their individual and 
summary reports did contain errors. For example, some of the VISN percentages in the 
August report exceeded 100. The Y2K office has also contacted selected medical 
facilities and acknowledged that the reports have errors. To address this issue, the Y2K 
office is currently contacting and visiting sites to discuss these reporting issues. It is 
critical that the medical facilities accurately report their Y2K progress in renovating their 
noncompliant systems so that top management within VA can identify problem areas and 
take prompt and appropriate action. 
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VHA HAS MADE PROGRESS IN DETERMINING Y2K 
COMPLIANCE STATUS OF BIOMEDICAL EQUIPMENT 

The question of whether VHA’s medical devices such as magnetic resonance imaging 
(MRI) systems, x-ray machines, pacemakers, and cardiac monitoring equipment can be 
counted on to work reliably on and after January 1, 2000, is critical to VHA. To the 
extent that biomedical equipment uses computer chips, it is vulnerable to the Y2K 
problem. In the medical arena, such vulnerability carries with it possible safety risks. 

VA Continues to Collect Compliance Information 
on Biomedical Eouioment 

In April, we testified before this Subcommittee that VHA was continuing to collect 
information from biomedical equipment manufacturers on the Y2K compliance status of 
equipment in its inventory.^^ As shown in table 2, a little over half of the manufacturers 
in VA's database reported directly to the department that their products are compliant as 
of October 25, 1999. Since we last testified, VA has created a new compliance category 
to capture the increasing number of manufacturers that have web sites with Y2K 
information. VA repotted that about 24 percent of the manufacturers in its database 
(1,393) arc in this new category. 


^ GAOfr-AIMI>-99-t36. April 15, 1999. 
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Table 2: Status of Manufacturer Responses to VHA as of October 25. 1999 



Number of 

Percentage of 

Manufacturer response 

Manufacturers 

manufacturers 

Manufacturers with web site 
information 

340 

24 

Compliant manufacturers' 

720 

52 

Noncompliant manufacturers'' 

33 

2 

Conditional-compliant 

manufacturers' 

40 

3 

Pending manufacturers'* 

11 

1 

Manufacturers merged or 
bought out 

241 

17 

Nonresponsive manufacturers’ 

8 

1 

TOTAL 

1393 

100 


Tor inclusion in this category^ 100 percent of a manufacturer’s products had to be ctmsidered 
compliant. 

Tor inclusion in this category^ only one of a manufacturer's products had to be considered 
noncumplunt. 

For inclusion in this category, the manufacturer had to have no noncompliant devices, no 
pending devices, and at least one conditiorul-compliant device. 

Tor inclusion in this category, the manufacturer had to have no noncompliant devices and at 
least one device that is periling. 

Tor inclusion in this category, VHA had to have not received compliance information fixm the 
manufacturer. 

Source: Veterans Health Administration. We did not indepertdently verify these data. 


Fornonresponsive manufacturers, VHA’s Y2K project manager told us that the project 
office had contacted the facilities that reported devices in their inventories from these 
manufacturers and instructed them to make a decision on their disposition. The project 
manager further stated that none of these devices was used in critical care or life support 
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functions, and that the facilities with this equipment had been instructed to plan for 
contin^ncies in the event any of diemexpeiience a Y2K-iBlated failure. 

In April 1999, VHA issued a policy establishing (1) a review process for medical devices 
whose compliance status was unknown, noncompliant, or conditionally compliant, and 
(2) options for what action should be taken on these devices. Options included replacing 
or retiring the equipment, or using it as-is. “ Medical facilities were to complete these 
reviews by June 1, 1999, for equipment whose Y2K compliance status was either 
unknown or noncompliant. and September 1 for equipment whose status was 
conditionally compliant. In each case, the medical facility director's approval of the 
disposition decision was required. For noncompliam equipment, the medical center was 
required to assess the level of risk if it continued to use the equipment, and determine 
what risk such use posed to patient health and safety. To make this assessment, medical 
facilities were to consider such questions as whether the device is used for cridcai care, or 
if the device used date-sensitive data, such as sequencing patient data results. 

To track the compliance status of its biomedical equipment. VHA uses a monthly status 
report on medical devices based on information provided by the VlSNs/medical facilities. 


Conditionally compliant equipment requires user intervention to function in all aspects upon the year 
2000 change. These changes inctude manufacturer software or hardware updates, or a one-tiine user 
action, such as turning the equipment onioff. Noncompliant equipment means a medical device wiH not 
function properly in all aspects upon the year 2000 change and no manufacturer remedy is available. 
Unknown equipment means VHA has not been able to determine the compliance status of equipment 
because it has not received compliance status information from the manufacturer. 
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According to the August 1999 report, about 97 percent of the 568,000 medical devices in 
VHA medical facilities are compliant. The report indicated that, of about 18,000 
noncomplituit devices, about 14,000 will be repaired, and about 1,400 will be replaced. 
The report did not discuss the renovation status of the remaining 2,200 noncompliant 
devices. 

We were unable to accurately determine the status of medical facilities’ efforts to 
renovate noncompliant devices. As we discussed previously, the individual monthly 
reports submitted by the VISNs/medical facilities were inaccurate. Specifically, the July 
1999 summary report that showed that about 21 percent of medical devices had been 
renovated was incorrect. However, according to several medical centers, their renovation 
percentages were higher than the numbers reflected in the report. We pointed this out to 
the Y2K project manager, who acknowledged that the percentages were incorrect. He 
added that the Y2K project office is in the process of following up with its medical 
centers to confirm their status on renovation of biomedical equipment. 

VHA Position on Not Testir.t 
Biomedical Eouiranent Unchanged 

As we reported last September, VHA relies on manufacturers to validate, test, and cenify 
that equipment is Y2K compliant.^* We also reported that there was no assurance that the 


” GACVAIMD-9S-240. Sqaemtier 18, 1998. 
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manufacturers adequately addressed the Y2K problem for noncompliant equipment, 
because FDA did not require medical device manufacturers to submit test 
results to it certifying compliance. Accordingly, we recommended that VA and HHS 
take prudent steps to jointly review manufacturers' compliance test results for critical 
care/life support biomedical equipment. We were especially concerned that VA and 
FDA review test results for equipment previously determined to be noncompliant but 
now deemed compliant by manufacturers, or equipment for which concerns about 
compliance remain. We also recommended that VA and HHS determine what legislative, 
regulatory, or other changes were necessary to obtain assurances that mamifacturers' 
equipment was compliant, including performing independent verification and validation 
of the manufacturers' certifications. 

At that time, VA stated that it had no legislative or regulatory authority to implement the 
recommendation to review test results from manufacturers. VA and the Emergency Care 
Research Institute (ECRl) have stated that manufacturers are best qualified to analyze 
embedded systems or software to determine Y2K compliance. Accordingly, they do not 
encourage user testing of biomedical equipment for Y2K compliance. ECRI guidelines, 
however, suggest that health care facilities should consider resting imerfaces between 
medical devices in cases whemhc facility cannot determine the Y2K compliance of the 
interlace from the device manufacturer. FDA also agrees with the ECRI position on 


'' This imtitHte is an miernationaJ, nonprofit health services research agency, ll believes that superficial 
testing of biomedical equipment by users may provide fzlse assurances, as well as create legal liability 
exposure tiir health care institutions. 
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testing biomedical equipment and interface testing. Specifically, FDA has taken the 
position that manufacturers’ submissions of Y2K compliance certifications provide 
sufficient assurMice of product compliance, and that such testing on the part of users is 
not necessary. 

According to VHA’s chief biomedical engineer. VHA guidance to the VISNs and 
medical facilities is not to conduct stand-alone compliance testing of biomedical 
equipment in their inventories. VHA’s Y2K project manager told us that VHA relies on 
the manufacturers’ certifications; therefore, there is no need for such testing. However, 
he stated, in cases in which one medical device interacts with other systems or devices, 
the medical facilities should test these to ensure proper operation. 

In contrast to VHA's and FDA's positions, some hospitals in the private sector believe 
that testing biomedical equipment is necessary to prove that they have exercised due 
diligence in the protection of patient health and safety. As we have previously testified, 
officials at three hospitals told us that their biomedical engineers established their own 
test programs for biomedical equipment and. in many cases, contacted the manufactureis 
for their test protocols.” Several of these engineers Informed us that their testing 
identified some noncompliant equipment that the manufacturers had earlier certified as 
compliant. According to these engineers, the equipment found to be noncompliant ail 
had display problems; none was critical care/life support equipment. We were told that 
equipirrent found to be incorrectly certified as compliant included a cardiac 


“GAO/T-AIMD-99- 136. April 15, 1999. 
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catheterization unit, a pulse oxymeter, medical imaging equipment, and ultrasound 
equipment. 

Our review of manufacturers’ web sites disclosed that manufacturers’ opinions vary on 
whether users should test their biomedical equipment.” We noted that at least 37 
manufacturers provided information on their web sites about Y2K testing. Of these, 30 
encouraged testing, and 1 5 of these 30 provided end-users with information such as test 
protocols and instructions. Fifteen of the 30 manufacturers also encouraged users to test 
their devices in configuration with related equipment to ensure that the device operated as 
intended. For example, the web site of a manufacturer of audiometers stated that “if your 
equipment is used in a critical application, we strongly advise you to test the equipment 
by simulating the millennium date change yourself.” Seven of the 37 manufacturers did 
not encourage testing; two of these stated that such testing could disrupt operation of 
software. 

Since some biomedical equipment manufacturers encourage end-user testing for Y2K 
compliance of their products, VA should reconsider its decision not to test equipment in 
those instances in which the manufacturer encourages users to test. Such action can 
provide greater assurance of Y2K compliance for those items. From an overall 
perspective, as we testified in April, the question of whether to independently verify and 
validate biomedical equipment that manufacturers have certified as compliant is one that 
must be addressed jointly by medical facilities' clinical staff, biomedical engineers, and 

Year 2000 Computing Challenge: Compliance Status Information on Biomedical Equipment (GAQ/T- 
AIMEM»-26. October 21, 1999). 
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corporate management.^ The overriding criterion should be ensuring patient health and 
safety. 


VHA PHARMACEUTICAL OPERATIONS HAVE 
M.\DE PROGRESS IN ADDRESSING Y2K PROBLEM 


Another critical component to VA's ability to deliver health care at the turn of the 
century is ensuring that the automated systems supporting VHA’s medical facility 
pharmacies and its consolidated mail outpatient pharmacies (CMOPs) are Y2K 
compliant VHA reported that in 1998 it filled about 72 million prescriptions for 3.4 
million veterans, at an estimated cost of about S2 billion. About half of the prescriptions 
were filled by the over 200 pharmacies located at VA’s medical centers, clinics, and 
nursing homes. These pharmacies rely on the pharmaceutical applications in their 
hospital information system for (I) drug distribution and inventory management, (2) 
dispensing of drugs to inpatients and outpatients, (3) patient medication information, and 
(4) an electronic connection between the pharmacies and the CMOPs. 

The remaining half of VHA's prescriptions are filled by seven CMOPs, geographically 
dispersed throughout the United States. These facilities are supported by automated 
systems provided by one of two contractors — Sl/Baker, Inc. and Siemens ElectroCom.” 
For example, the CMOP electronically receives a prescription for a veteran through the 
medical center. The prescription is downloaded to highly automated dispensing 

“OAO/T-AIMD-99- 136. April 15. 1999. 

^ These include opersling systems, delabases. and pharmacy fuinilmenl applicalion software. 
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equipment to be filled. The filled prescription is then validated by a pharmacist who 
compares the medication against the prescription and a computerized image of the 
prescribed medication. Afterward, the prescription is packaged and an automatically- 
generated mailing label is applied for delivery to the veteran. Lastly, the medical center 
is electronically nodded that the prescription has been filled. 

As we testified tins past April,^° VHA had determined that the automated systems 
supporting its CMOPS were not y2K compliant. Accordingly, the CMOPs' ability to fill 
prescriptions and process management reports could be delayed or interrupted if a Y2K 
failure occurred. At that time we also expressed concern about the mid- to late-1999 
scheduled implementation of compliant systems. 

Since our April testimony, VA's contractors have installed and tested compliant systems 
at all seven CMOPs. As shown in table 3, as of September 30, 1999, all seven CMOPs 
have reported their automated systems as compliant. 


®GAOrr-AIMD-99-136, April 15. 1999. 


25 



52 


Table 3: Actual Completion Dates for Implemetning Compliam Systems and Cunenl 
Daily Wwfcload bv Consolidated Mail Ou tpatient Phamiacies 


Location 

Actual Completion 

Date 

Current Daily Wotkioad 

fpreaniptions filled) 


August 10, 1999 

13,000 


August 10, 1999 

14.000 

1 West IxK Angeles, 

1 California' 

September 8, 1999 

15,000 



September 30. 1999 

16.000 


September 22. 1999 

38,000 


September 26, 1999 

23,000 

1 

September 26, 1999 

21,000 


'Siemens ElectroCom automation 
'’SI/Baker, Inc. automation 

Source: VA. 


We also lestifled in April that it was crucial that the CMOPs develop business continuity 
and contingency plans to ensure thtf veterans will continue to receive their medications 
should the CMOPs experience a Y2K-related failure. On September 3, 1999. the national 
CMOP direcloi approved the Consolidated Mail Outpatieni Pharmacy Year 2000 
Contingency Plan which (1) defines the resptmsibilities of the national director, the local 
CMOP director, the national Y2K coordinators, the local Y2K cootdinatore. and the 
business resumption team; (2) establishes procedures for preparing md implementing the 
contingency plan and implementing it during the execution phase: and (3) provides a 
schedule of critical events and a lime line for actions to be biken during the execution 
phase. 
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In addition, each of the seven CMOPs drafted contingency plans addressing core business 
processes. These plans, along with the Y2K Mail Transfer Contingency Test Procedures, 
which are the necessary steps relating to loss of the wide area network, were forwarded to 
the medical centers serviced by each CMOP during July and August of this year. Each 
medical center was asked to certify that the CMOP contingency plan had been reviewed 
and will be incorporated into the medical center’s Y2K contingency plan. However, 
according to the national CMOP Y2K coordinator, as of October 25, 1999, about half of 
the medical facilities had not returned their certifications. 

According to the CMOP Y2K plan, the CMOPs are expected to completely test their 
plans by the end of October. Five CMOPs participated in a live test last month. 
Specifically, anticipating a direct hit from Hurricane Floyd, the Charleston CMOP 
reallocated the prescriptions for its 21 medical centers to four other CMOPs — Bedfotil, 
Dallas, Hines, and West Los Angeles. The Charleston CMOP lost 36 hours of production 
time, and 55,683 prescriptirms had to be processed by the other CMOPs. 

VA Continues Efforts to Det ermine Y2K Readiness of 
Pharmaceutical and Medical-Surgical Manufacturers 

Like other users of pharmaceutical and medical-surgical products. VA needs to know 
whether it will have a sufftcienl supply of these items for its custotttets. Therefore, it has 
taken a leadership role in the federal government in determining whether manufacturers 
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supplying these products to VHA are Y2K-ready. This information is essential to VHA’s 
medical facilities and CMOPs because of their “just-in-time”” inventory policy. 
Accordingly, they must know whether their manufacturers' processes, which are highly 
automated,’^ are at risk, as well as whether the rest of the supply chain will function 
properly. 

We testified in AjHil that VA’s National Acquisition Center ” sent a survey on January 8, 
1999, to 384 pharmaceutical firms and 459 medical-surgical firms with whom it does 
business to determine their Y2K readiness,” The survey contained questions on the 
firms’ overall Y2K status and inquired about actions taken to assess, inventory, and plan 
for any perceived impact that the century turnover would have on their ability to operate 
at normal levels. In addition, the firms were requestedto provide status information on 
progress made to become Y2K compliant, and a reliable estimated date when compliance 
would be achieved for business processes such as (1) ordering and receipt of raw 
materials, (2) mixing and processing product, (3) completing final product processing, (4) 
packaging and labeling product, and (S) distributing finished product to 
distributors/wholesalers and end customers. 


This term refers to iruintaiiiing a limited inventory on hand. 

^ Many pharmaceulica] manufacturers rely on automated systems for production, packaging, and 
distribution of their products, as well as for ordering of raw materials and supplies. 

This organization is responsible for supporting VHA’s health care delivery system by providing an 
acquisition program for items such as medical, dental, and surgical supplies and equipment; 
pharmaceuticals; and chemicals. The National Acquisition Center is pan of VA's Office of Acquisition and 
Materiel Management. 

^ Five additional firms were identified from survey responses received after April 1999. 
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In March the acquisition center sent a second letter to its pharmaceutical and medical- 
surgical Arms, informing them of VA’s plans to malce Y2K readiness information 
previously provided to VA available to the public through a web site 
(www.va.y nv/na*mi ii/nac/v2kl . VA made the survey results available on its web site on 
April 13, 1999.^’ The letter also requested that manufacturers that had not previously 
responded provide information on their readiness. The acquisition center’s executive 
director said that he would personally contact any major VA supplier that did not 
respond. 

According to an August 1, 1999, brieflng report on their survey, the acquisition center 
reclassified the S17 companies that responded to the survey into three categories: 
“pharmaceutical fitms,”“ “pharmaceutical, other firms,"” and “medical-surgical firms.” 
As shown in table 4, as of August 1, 1999, the latest available date from VA, about one- 
third of the pharmaceutical firms, a little over one-third of the “pharmaceutical, other” 
and almost 44 percent of the medical-surgical firms had not responded to the survey. 


” This site identified the firms that were sent surveys and those that responded. 

^ Films that manufacture and distribute both pharmaceulicats and medical/surgicaJ are included in the 
pharmaceutical category. 

” Pharmaceutical firms that also manuracture and distribute medical gases and reagents (substances used in 
chemical leactktiis to detect, measure, examine, or produce other substances). 
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Table 4: Status of Companies Surveyed bv VHA as of August 1. 1999 


Responses 

Pharmaceutical 

Pharmaceutical, 

other 

Medical- 

surgical 

Y2K compliant 

55 

28 

146 

Will be compliant by 1/1/2000 or 
earlier* 

92 

30 

79 


39 

14 

34 

Total number of responses 

186 

72 

259 

Non-responses 

90 

40 

201 

mmmmaESBsssm 

276 

112 

460 


'Estimated compliance status date ranged from 3/31/99 through 1/1/2000; about 72 percent of all 
respondents estimated they would be compliant by 7/31/99. One firm responded that it would be compliant 
by 1/01/2000. 

Source: VA. We did not independently verify these data. 


To determine if all respondents who had initially provided an anticipated compliance date 
of July 31, 1999, or earlier had met this date, a follow-up survey was sent to 140 firms on 
July 20, 1999. As shown in table 5, as of October 26, 1999, about two-thirds (64 percent) 
responded to the survey. A little over half of the respondents (52 percent) completed the 
survey, while the remaining respondents forwarded company letters. Year 2000 readiness 
disclosure statements, and company financial statements with disclosures on Y2K 
readiness. Table 5 also shows that about half of the respondents did not meet the targeted 
date of July 31, 1999; almost 84 percent, however, anticipate full compliance by 
September 30, 1999. The results of this follow-up survey are not currently available on 
VA’s web site. 
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Table 5: Status of Companies with July 3 i . 1999. Or Earlier Anticipated Compliance 
Date as of October 26. 1999 



Number of Firms 

Percentage 

Total number of surveys distributed 

140 

100 

Number of responses 

90 

64 


47 

52 

Were compliant by 7/31/99 

25 

53 

Anticipate compliance by 9/30/99 

19 

40 

Anticipate cOny>iiance bv fourth quarter 

3 

6 

Firms forwarding company letters, etc. 

43 

48 

Were compliant by 7/31/99 

17 

40 

Anticipate compliance by 9/30/99 

14 

32 

Anticipate compliance by fourth quarter 

3 

7 

No date furnished 

9 

21 


Source: VA. We did not independently verify these date. 


On a broader level, VHA has taken a teadeiship role in obtaining and sharing information 
on the Y2K readiness of the pharmaceutical industry. Specifically, VHA chairs the Year 
2000 Pharmaceuticals Acquisitions and Distributions Subcommittee, which reports to the 
Chair of the President’s Council on Year 2000 Conversion. The purpose of this 
subcommittee is to bring together federal and pharmaceutical representatives to address 
issues concerning supply and distribution as it relates to the year 2000. The 
subcommittee consists of representatives of FDA, federal health care providers, and 
industry trade associations such as the Pharmaceutical Research and Manufacturers of 
America, the National Association of Chain Drug Stores, and the National Wholesale 
Druggists’ Association, Several of these trade associations have surveyed their members 
on their Y2K readiness and have made the results available lo the public. Further, the 
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Pharmaceutical Alliance for Y2K Readiness^ announced on September 22, 1999, that 
consumers will have access to a substantial supply of medications during the Y2K date 
change and there should be no need for consumers to overbuy medications in preparation 
forY2K. 

The executive director of the National Acquisition Center told us that, based on his 
interactions with the trade associations, as well as results received from manufacture!^, he 
is confident that there will be no shortage of medication and medicafsurgical supplies. 

He explained that the major companies with unique drugs that VA relies on have 
responded that they will be ready and have provided the necessary resources and 
management attention. Further, he said, all ten of VA’s largest pharmaceutical and 
medical-surgical suppliers have responded to the survey and have taken actions to 
address the Y2K problem at their finns. Accordingly, the executive diiector does not 
plan to take any further action, including following up with those manufacturers that did 
not meet their anticipated compliance date of July 31, 1999. or September 30, 1999. 

We believe that VHA needs to continue to follow up with pharmaceutical and medical- 
surgical firms that anticipated having compliant systems by July 31, 1999, and September 
30, 1999, to determine whether these firms have addressed the Y2K problem. This 
information should also be made available on VHA’s web site. 


*A coalition of drug manufaaurers, wholesale distributors, pharmacies, and health care organiztfions that 
are waking closely with govemmem agencies to eisure a contintMd and substantial su{^y of 
|Aarni<»:eu)iC3ls through January 1 . 2000. 
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FDA S Y2K ACTIVITIES ON BIOMEDICAL EQUIPMENT AND 
PHARMACEUTICAL. BIOLOGICAL. AND 
CONSUMABLE MEDICAL PRODUCTS 
INDUSTRIES ARE FOCUSED ON READINESS 

Another key player in detennining the Year 2000 compliance of biomedical equipment 
and pharmaceutical, biological, and consumable medical products is FDA, which has 
oversight and regulatory authority in these areas. FDA's role is to ensure that these 
products are safe and effective for public use. In an effort to provide users with Y2K 
compliance information on their equipment, FDA has established the Federal Y2K 
Biomedical Equipment Clearinghouse. In addition, it has surveyed iiuuiufactureis of 
pharmaceutical, biological, and consumable medical products, to provide users with 
intormation on their Y2K readiness. 

Biomedical Equipment Status Information 
Available Through FDA Clearinahouse 

We repotted in September 1998 that FDA was working to determine the compliance 
status of biomedical equipment; provide a comprehensive, centralized source of 
information on the Y2K compliance status of biomedical equipment used in the United 
States', and make this information publicly available on a web site.” However, we also 
reported that FDA's database (hd not include poduct compliance information from many 


” GACWAiMD-98-240, Sepwmber 18, 1998. 
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manufaclUFcrs that had already provided such information to VHA, and also that VHA 
was not making this information available to the public. We therefore recommended that 
HHS and VHA jointly develop a single data clearinghouse containing information on the 
Y2K compliance status of biomedical equipment, and make this information publicly 
available. In response to our recommendation, FDA — in conjunction with VHA — 
established the Federal Y2K Biomedical Equipment Clearinghouse. In obtaining 
compliance status information from manufacturers, VHA, the Department of Defense, 
and the Health Industry Manufacturers Association all assisted FDA. 

We testified last week that, according to FDA, 4,288 biomedical equipment 
manufacturers had submitted data to the clearinghouse as of October 4, 1999.“ Based on 
the data submitted, FDA places a manufacturer into one of four categories: 

• Products that do not employ a date — manufacturer that reported Y2K status to be “All 
Products Do Not Use a Date.” 

• Pixxlucts that are all compliant — manufacturer that reported products as Y2K 
compliant. 

• Products with date-related problems — manufacturer that reported its Y2K status to be 
“Products With Date Related Problem." 

• Product status is on the manufacturer's web page — manufacturer that repotted its 
Y2K status to be “Product Status Specified on a (Web) Page.” 


* GAO/T-AtMD-00-26. October 2 1 , 1999. 


34 




61 


As shown in figure 1. as of October 4, 1999, 61 percent of the manufacturers repotted 
having products dial do not employ a date, while 8 percent (342 manufacturers) reported 
having date-related problems such as incorrect display of date/time. According to FDA, 
the 342 manufacturers reported 1,03S speciHc products with date-related problems. 

Figure I: Biomedical Eauioment Comoliance-Smtus Information 
Repotted to FDA bv Manufacturers as of October 4. 1999 . 



Note: Total number of manufacturers = 4,288. 
Source; FDA. 
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Also, according to FDA, as of October 4, 1999. 132 manufacturers had not responded to 
the agency’s request for product compliance information. A senior FDA official told us 
that most of these manufacturers have gone out of business, do not make computerized 
products, or just cannot be located. The official added that FDA continues to follow up 
with these manufacturers nevertheless, through letters and telephone contact. The 
clearinghouse lists the names of these manufacturers that have not responded to FDA’s 
requests for product compliance information. 

In our September 1998 report, we also noted that information on the FDA web site was 
not detailed enough to be useful.^’ Specifically, the list of compliant equipment 
contained no information on the equipment’s make and model. We therefore 
recommended that VA and HHS include in the clearinghouse information on the 
compliance status of all biomedical equipment by make and model. FDA agreed with 
this recommendation, and subsequently requested this information from manufacturers; 
users can now find specific information on the make and model of compliant medical 
devices on the FDA web site. 

As an alternative to obtaining biomedical equipment product compliance information 
from manufacturers and posting it to the Federal Y2K Biomedical Equipment 
Clearinghouse, FDA accepts equipment manufacturers’ references to their own web sites 


GAO/AIMD-98-240, September 18, 1998. 
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for compliance information. The clearinghouse provides users with a link directly to 
these web sites. As of October 4, 429 manufacturers had chosen this option. 

While FDA is aware of the number of products and their reported compliance status for 
those manufacturers providing this information to the Federal Y2K Biomedical 
Equipment Clearinghouse, in testimony this past May FDA officials stated that they did 
not know the total number of biomedical equipment products reported by manufacturers 
on their web sites, or how many of them were noncompliant. We subsequently reviewed 
information available through these web sites and reported in June that the quality of 
information available through them varied significantly.^^ Specifically, we found that 
while most sites contained compliance inform^ion on at least one product, some sites 
contained insufficient information or did not clearly distinguish biomedical equipment 
from nonbiomedical products. 

We subsequently updated our analysis of the web sites as of October 1, 1999, and found 
the following for the 429 manufacturers in FDA's clearinghouse that refer users to their 
web sites; 

• 354 manufacturers reported compliance status information for at least 33,598 
individual biomedical equipment [Hoducts,^^ 


Year 2000 Competing ChaUettge: Concerns About Compliance h^rmation on Biomedical Equifmteni 
(GACVT-AlMD-99-209. June 10, 1999). 

This includes medical devices and scientific and research instruments, and other suf^xMting products, 
such as printers and Krftware. 
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■ 7 1 manufsK^turere’ web sites either contained insufficient information on the number 
of products and their compliance status, or did not clearly distinguish biomedical 
equipment from nonbiomedical products, 

• 3 web sites were those of vendors or distributors, not manufacturers, and 

■ 1 manufacturer’s web-site link in FDA’s clearinghouse did not work,** 

Because of the limitations cited above for many of the manufacturers’ web sites, our 
ability to determine the total number of biomedical equipment products reported and their 
compliance status was limited. Accordingly, the actual number of products reported by 
these manufacturers could be higher than the 32,598 that we counted. 

As shown in figure 2, of the 32,598 products we identified on manufacturers’ web sites, 
about 54 percent reportedly do not employ a date, about 29 percent of the products are 
considered compliant, and about 12 percent are reportedly noncompliant. The 
compliance status of the remaining 5 percent of pitxiucts was unknown for reasons such 
as the manufacturer’s ongoing assessment of the product. 


** According to FDA, the contractor assisting it widi Uie clearingbouse verified that this web site link was 
operable. 
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Figure 2: Biomedical Eouipment Comoliaiice-Slalus Information 
Reported on Manufacturers’ Web Sites as of October 1 - 1999 . 



Note; Total number of products = 32,598. 

Source: GAO analysis of manufacturers’ web sites. 

The 4,053 noncompliant products that we identified were from the web sites of 214 
manufacturers. This number of products is about four times the number reported directly 
by FDA in its clearinghouse (1,035). Examples of these noncompliant products included 
a bedside monitor, film digitizer, ultrasound systems, radiology information systems, and 
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laboratory information systems. Included among noncompliant potentially high-risk 
devices repotted were ventricular assist devices and hemodialysis equipment.*^ 

In addition to supplying information on noncompliant products, most of the 
manufacturers with noncompliant producu also provided solutions to correct the 
problem. Most (190) of the 214 manufacturers identified with noncompliant products 
provided at least one solution to correcting the problem. The solutions generally 
involved upgrades to hardware or software, manual action (such as turning the equipment 
on and off on January 1, 2000), or woricarounds.'* 

FDA Is Now Reviewing 
Manufacturer s’ Y2K Activities 

While compliance information is available through FDA's Federal Y2K Biomedical 
Equipment Clearinghouse, we have raised concerns in the past year about the lack of 
independent verification and validation of biomedical equipment that manufacturers have 
certified as compliant. In addition to making sure that manufacturers provide detailed 
information on their products, we believe that it is essential that FDA provide some level 
of confidence that critical cate and life support medical devices will work as intended. 


A vealriculir assist device is a small eleciromechanicat pump lhal helps maintain blood circulation in 
patients sutreritlg from end-stafe heart disease. Hemodialysis equipment cycles blood from a patient's 
body to filler out body waste before leturntns the blood to the paiieai. 

* An example of a workarouiid is notins on the printout of an EKG machine the year **2000” instead of 
"1900." 
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In response to our reconunendation to conduct independent verification and validation of 
biomedical equipment that manufacturers have certified as compliant, FDA is taking 
action to review a sample of biomedical equipment manufacturers’ Y2K activities, such 
as risk management, test planning and procedures, and implementation and contingency 
planning. Specifically, FDA’s acting deputy commissioner for policy testified in May 
1999 that FDA proposed reviewing manufacturers' test results supporting their 
compliance certifications for a sample of critical devices. FDA’s proposal consisted of 
two phases. In the first phase FDA would 

■ develop a list of the manufacturers of computer-controlled, potentially high-risk 
devices (PHRD);" 

• from this list of manufacturers, select a sample of 80 manufacturers for review; and 

■ hire a contractor to develop a program to assess manufacturers’ activities to identify 
and coirect Y2K problems with PHRDs. 

The goal of the first phase of the survey is to extrapolate from the 80 assessments a level 
of overall confidence in the biomedical equipment industry’s Y2K compliance activities. 
According to FDA, the second phase of the evaluation would be undertaken only if the 
results of the first phase indicated a need for further review of manufacturer Y2K 
activities because of concerns over how manufacturers are addressing product 
compliance. 


These medical devices are characterized by their potential for immediate and serious adverse health 
consequences tor a patient if they tul to function as designed or eapected. including a fotlure to initiate or 
continue operations. 
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In carrying out its plan to assess manufacturers’ Y2K activities, FDA identified 90 types 
of PHRD products, and issued a task order on July 1 , 1999, for a contractor, assisted by 
two subcontractors, to perfoim assessments of the Y2K compliance activities for a 
sample of PHRD manufacturers. FDA identified 803 PHRD manufacturing sites that 
produce equipment sold in the United States." These were comprised of 726 biomedical 
equipment manufacturing sites and 77 manufacturing sites of blood and blood products 
equipment. 

FDA's contractor then randomly selected 32S of the 803 sites for possible assessment. 
These manufacturing sites were then contacted and asked if they would volunteer to 
participate in the process. As of October 4, 1999, of the 325 randomly selected sites, 

• 197 were identified as producing no computer-controlled equipment, 

• 80 agreed to participate, 

• 26 declined to participate," 

• 18 were duplicates,’'’ and 

• 4 did not respond. 

To carry out the on-site assessments of manufacturing sites, the contractor developed a 
guide for its examiners. This guide focused on the firm's Y2K activities in six areas: (1) 
executive leadership and control, (2) risk management, (3) corrective and preventive 


“ TIk t03 cofuisieil of ihoK maniraaurers Uui hid resiuend FHRD imidiKU widipDA dial were anung 
die90 types orPHROi ideali6ed. 

* ReaacMt fivoi by maMfKnren tor dedimag IS pinicipMe adaded achedaliiit nr leaouice liniaiioiit, 
and recent regular FDA she inpeciiaas. Five niaiiuiactiniigiiies declined wMiaM giving a reason. 

” These sues nivolved large, mulli-sile manutaciuren where the FDA connactor had already sdecisd two 
or more of the manufacturer's sites. According to FDA, the cotn r ic i or did nor assere dup Hca ie s if they 
came up in later samples. 
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actions, {4) test planning and procedures, (5) communication with the consignee (user of 
the products), and (6) implementation and contingency planning. 

After completing these assessments, examiners were required to prepare a report of 
concerns in each of the six areas reviewed at each manufacturing site. Concerns were 
identified as high, medium, or low, as defined below: 

• high — relates to actions that are not timely, inadequate planning, inadequate or 
incomplete resources, incomplete or inaccurate deliverables, unable to validate 
results, and/or inadequate due diligence; 

• medium — relates to actions that are somewhat late, incomplete planning, insufficient 
or incomplete resources, deficiencies in deliverables, and/or incomplete validation of 
results; and 

• low — relates to actions that are on schedule, and have adequate resources. 

According to FDA’s PHRD survey project manager, as of October 15, 1999, examiners 
had completed all 80 manufacturer site assessment visits, and had prepared 62 assessment 
reports. 

We reviewed the 25 manufacturer site visit reports that were completed by the examiners 
and available to us as of September 10, 1999, For 20 of these assessments, concern was 
low. At the five remaining sites, the examiner assessed at least one concern as moderate 
in one of the six areas, such as test planning and procedures. According to the FDA 
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PHRO survey project manager, the areas identified in the site visit reports as medium 
risks do not constitute a risk to patient health or safety. 

Until recently, none of the site visit reports submitted to FDA contained a concern 
assessed as high. However, last week, the PHRD survey project manager informed us 
that FDA had received a site visit report with concerns accessed as high in two areas — 
leadership and control, and test planning and procedures. The report stated that the 
manufacturer's polices and procedures were found to be inconsistent, ambiguous, and 
were not followed in a manner that would meet due diligence requirements. It also noted 
that the qualifications of the manufacturer's personnel for specified tasks were not well 
defined, and that some personnel assigned to tasks identified in the policies and 
procedures were not qualified to perform those tasks. The report concluded that the 
manufacturer's procedures for Y2K assessment and corrective and preventive action were 
less than adequate, and that assessment procedures had not been applied consistently. 

The manufacturer subsequently told the examiner that action would be taken on the 
issues raised. 

Late last week, FDA's Senior Associate Commissioner for Policy, Planning, and 
Legislation testified that FDA sent an inspector to follow up with this manufacturer. The 
FDA official said the inspector determined that the deficiencies noted would not affect 
patient safety. He also suted that FDA would continue to monitor the situation at this 
site. 
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Regarding the overall planned phase one report, the project manager told us that FDA’s 
contractor is in the process of preparing a final report summarizing the findings from the 
80 site visit assessment reports, detailing any problems encountered during the project 
and recommending whether the second phase should be performed. Although FDA 
initially expected to submit a final report to HHS by October 1, it has not yet established 
a revised deadline. Accordingly, it does not know when this information will be made 
available to the public. We believe that this information should be made available as 
soon as possible. 

To assess how the contractor was executing FDA’s task order, we observed selected site 
visit assessments. At the five manufacturing site assessments we observed, the examiners 
generally followed the contractor-developed audit guide, and were knowledgeable about 
information technology management, Y2K testing, and risk assessment. During our two 
initial visits, we noted that the examines sometimes could not answer questions from the 
manufacturers relating to the FDA clearinghouse and the processing of the final report on 
the site assessments. We subsequently shared these observations with FDA official, who 
agreed to consider our suggestions, such as better communicating to the firms the final 
reporting process and how the FDA Federal Y2K Biomedical Clearinghouse works. 
During the later three visits, we did not observe any similar areas of concern. 
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FDA’s Activities to Determine Y2K Readiness 
of Manufacturers of Pharmaceutical. Biological, and 
Consumable Medical Products 


FDA’s oversight and regulatory responsibility for pharmaceutical, biological, and 
consumable medical products*' is to ensure that they are safe and effective for public use. 
Since our April testimony,** FDA has taken action to determine the Y2K readiness of 
these industries. Specifically, FDA is conducting voluntary surveys of manufacturers of 
pharmaceutical, biological, and consumable medical products for Y2K readiness. These 
surveys assess manufacturers' plans and preparations to continue operations after January 
1 , 2000 . 

According to FDA's Senior Associate Commissioner for Policy, Planning and 
Legislation, information obtained from these surveys thus far indicates that there will 
likely be no significant disruption of necessary supplies of pharmaceuticals, biologicals, 
or consumable medical products as a result of Y2K. FDA believes that essential medical 
supplies will be available, and that the drug supply will be safe and adequate. 

To obtain information on the Y2K readiness of the pharmaceutical industry, on April 2 1 , 
1999, the FDA commissioner sent a letter to the presidents and CEOs of approximately 
4,228 pharmaceutical manufacturers that produce prescription drugs, over-the-counter 
medication, bulk drugs, and also to drug distributors and repackagers, and medical gas 

Biological products include vaccines, blood, and blood products. 

“GAO/T-AIMD-99- 136. April 15, 1999 
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manufacturers. In the letter, the commissioner requested the assistance of these firms in 
assuring the American public that the firms had addressed the Y2K problem as it affects 
the adequacy, safety and effectiveness of the supply of pharmaceuticals in the United 
States. 

According to FDA’s Senior Associate Commissioner for Policy, Planning, and 
Legislation, as of October 8, 1999, 3,132 (74 percent) of the firms had responded to the 
survey. Of these, 95 percent stated that they would be Y2K ready by October 31, 1999. 
According to the senior associate commissioner, FDA is committed to maximizing the 
response, especially from the 274 priority manufacturers who produce sole source, 
orphan drugs,” or the top 2(X> prescribed medications. 

This FDA official testified on October 21, 1999, that, in addition to conducting the 
survey of pharmaceutical manufacturers, distributors, etc., FDA is taking the additional 
step of obutining independent assurance of these firms' Y2K assessments and corrections. 
The agency has obtained a contractor that is auditing each of 160 highest priority 
pharmaceutical firms, as well as a random sample of other firms. As of October 8, 1999, 
88 percent of these assessments have been completed- The report stated that the results 
of their audits to date are positive and confirmed FDA’s expectation that the 


Orphan drugs are those produced under provisions of the Orphan Drug Act tP.L.97-414, § 983, as 
amended). Hw act provides incentives for manufacturers to produce drugs that are used by a smail number 
of patients to treat a specific, but not widespread, medical condition. 
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phannaceutical industry has taken the necessary steps to prepare for the year 2000. TTie 
interim report” is available on FDA's web site.” 

FDA is also assessing the Y2K readiness of the biolo^cs industry. In June, the Center 
for Biolo^cs Evaluation and Research mailed a survey on Y2K readiness to 1 ,576 
licensed biologies manufacturers and registered blood establishments. FDA also sent 
letttrs to biologies trade organizations requesting their assistance in encouraging their 
mendiers to participate in the survey. 

According to FDA's senior associate commissioner, as of Octtdrer IS, 1999, it had 
received responses from 1,483 (94 percent) of the licensed manufacturers and blood 
establishments. In addition, as with the pharmaceutical industry, FDA is conducting 
follow-up audits of 1 10 high-priority firms to assess their Y2K readiness. To date. FDA 
reports finding no problems with the audited firms. In addititm, FDA is conducting 
random audits of other firms, and has completed audits of 48 of these with no problems 
identified as of October 14. 1999. FDA told us on October 27 that it plans to publicize 
the survey and audit results of the biologies manufacturers, although it has not established 
a date when this information will be available. We believe that this information should 
be made available as soon as possible. 


** Cmarfar Drug £valiaumi and Keuarch 'i Interim Rtpon: ftstettmettt the Pharmacemkal 
Industry's Readiness for Year *000. FDA. Oclvbcr 18. 1999. 

’’ The siie is loceied ai linD://www.fda.Mv/ciler/v2k . 
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FDA also mailed Y2K readiness surveys to 3,070 manufacturers of consumable medical 
supplies in June.“ This survey focused on manufacturers that produce critical devices 
that are used and consumed on a recurring basis during the delivery of essentia! health 
care services, as well as those whose availability is critical to the unintemipted delivery 
of health care and patient welfare. As of October 14, 1999, FDA had received 2,074 
responses (68 percent) to its survey. According to FDA’s senior associate commissioner, 
approximately 90 percent of these respondents report that they will be ready for Y2K by 
October 31, 1999. 

FDA is also conducting audits of firms that supply medical consumables. It has given 
highest priority to 225 firms that produce devices that are only manufactured by a handful 
of those firms, as well as 57 manufacturers that are sole-source suppliers. According to 
FDA’s senior associate commissioner, to date, 197 of the high-priority firms have 
responded, and 48 of the 57 sole-source firms have responded. On October 27, 1999, 
FDA told us that it plans to make the detailed survey and audit results for consumable 
medical products manufacturers available to the public, but it has not yet determined the 
date when this will be done. We believe that it is critical to make this information 
available. 


In summary, VA has made much progress in addressing the Y2K computer problem. 
However, some critical tasks remain in the areas of testing business continuity and 

^ Consumable medical supplies include such items as intravenous tubing, kidney dialysis filter units, and 
blood and blood product bags. 
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contingency plans and reporting Y2K compliance status of key components such as 
facility systems at VHA medical facilities. VHA should also reassess its decision not to 
lest iMomedical equi|mient in those instances in which the manu^tuier encourages such 
testing. Additionally, VA needs to continue to follow up with pharmaceutical and 
medical-surgical films that anticipated having compliant systems by July 31, 1999, and 
September 30, 1999, respectively, and make this information available to the public 
through iu web site. 

Compliance status information on biomedical equipment can now be found in FDA’s 
clearinghouse or on manufacturers' web sites. Also, to iu credit, FDA has assessed the 
Y2K compliance activities of some PHRO manufacturing sites. This information should 
provide the American public with a higher level of confidence that medical devices will 
work as intended. FDA now needs to finalize iu overall report on the results of iu 
review of the PHRO mmutfacturing sites, and nudie this information available to HHS 
and die public through its web site. 


We per fanned this assignment in accordance with generally accepted government 
auditing standards, from May through October 1999. In carrying out ibis assignment, we 
reviewed and analyzed VA's Y2K documenu and plaiu, comparing them against our 
guidance on \2K acUvities. Mote specifically, we observed VBA’s ’’(fry tun” testing of 
iu benefiu payment systems, VHA’s forward-date lesu of iu hospital information 
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systems, and tests of CMOP Y2K fixes. We reviewed the test plans, selected test scripts, 
and test results for each Y2K test. We also reviewed business continuity and contingency 
plans for a sample of for VHA medical centers and VBA regional offices, as well as 
VBA data centers. In addition, we reviewed and analyzed FDA documentation relating 
to its Y2K efforts on biomedical devices and pharmaceutical manufacturers. More 
specifically, we identified the amount and quality of information on product compliance 
information available on biomedical equipment manufacturers’ web sites, reviewed 
information from those sites to identify the total number of biomedical equipment 
products reported, and categorized their compliance status.” We also reviewed 
manufacturers’ web sites to assess the clarity and completeness of the information 
reported. 

In addition, we visited selected VHA medical centers, VBA regional offices, VA data 
centers, and VHA consolidated mail outpatient pharmacies to discuss their Y2K 
activities, and interviewed VA and FDA officials about those activities. Finally, we 
interviewed selected private hospital officials about their Y2K actions and 
pharmaceutical trade associations on their Y2K readiness surveys of pharmaceutical 
manufacturers. 


We summarized the results ot our review in four compliance categories — products that do not employ a 
dale, producis that are comphant. producii* that are noncompiiant, and products whose compliance status is 
cunwwiy unknown. This last category includes those manufacturers who reported that they have not 
completed an assessment of their products, have discontinued a product, or have a product that is now 
obsolete. 
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Mr. Chainnan, this concludes my statement. I would be pleased to respond to any 
questions that you or other members of the Subcommittee may have at this time. 
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INTRODUCTION 

Good morning/ my name is William K. Hubbard. I am the 
Senior Associate Commissioner for Policy/ Planning and 
Legislation/ Food and Drug Administration (FDA or the 
Agency) . I am pleased to be here today to provide an 
update on the Year 2000 (Y2K) date issue as it relates to 
medical devices/ drugs and biologies. In April of this 
year, I appeared before the Committee and discussed with 
you the need for FDA to allay the fears of the American 
public whether life-sustaining medical devices will 
function as intended and whether there will be a sufficient 
supply of high priority pharmaceuticals due to Y2K issues. 
At that time/ I told you that we were optimistic that the 
industries were taking the necessary steps to guard against 
Y2K breakdowns. Now that it is October and the year 2000 
draws near, I am here today to tell you about FDA's efforts 
to validate our optimism. 

FDA stepped up its efforts to gather more information on 
the Y2K readiness from industry through additional surveys 
and audits. This additional data provides FDA with a high 
degree of confidence in assuring the health care community 
and the American public that essential medical supplies 
will be available; and medical devices will function as 
intended; and that there will be a safe and adequate supply 
of drugs available. The Agency's efforts to obtain 
additional data and the high degree of confidence we have 
today is a tribute to the collaborative efforts among the 
Federal sector, healthcare community and industry. Let me 
summarize for you the Agency's efforts. 
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Y2K STATUS OF BIOMEDICAL DEVICES 

FDA has taken a number of steps to enhance the confidence 
of the American public that medical devices will function 
as intended as the year 2000 approaches. For the past two 
years, FDA has continued to add to its knowledge of the Y2K 
status of medical devices and to make this information 
available to healthcare facilities. In developing this 
high level of confidence FDA has taken a number of 
constructive actions to work with manufacturers and provide 
information to users about the Y2K compliance of medical 
devices. 

FDA's Y2K DATABASE 

An important tool for obtaining information about 
biomedical equipment is FDA*s Federal Year 2000 Biomedical 
Equipment Clearinghouse database. It is available via the 
World Wide Web at www. fda.gov . While the database has 
proven to be useful to healthcare facilities, professionals 
and consumers — receiving over 236,691 "hits" from 197,461 
users over a period of 17 months — FDA has continued to 
collect information from medical device manufacturers. 

FDA believes that approximately 2,300 of the 16,000 
biomedical equipment manufacturers could produce equipment 
that could be affected by the Y2K problem. The vast 
majority of these 2,300 manufacturers have responded to 
FDA's requests for Y2K status information, and every effort 
is being made to locate the remaining companies. 

SURVEYS AND ASSESSMENTS 

To bolster public confidence in industry's efforts to 
identify and resolve Y2K problems and to assure a continued 
supply of needed pharmaceuticals, biologies and essential 
medical supplies, FDA conducted a voluntary survey of 
manufacturers of drugs, biologies and consumable medical 
devices for Y2K readiness. These surveys assessed 
manufacturers' preparations and plans to continue 
operations after January 1, 2000. FDA then audited the 
survey results for a sample of the firms, as well as a high 
proportion of high priority firms to confirm the survey 
reports. These surveys indicate that the regulated 
industries have devoted considerable efforts to Y2K 
preparations and we do not expect significant interruptions 
of necessary supplies. 

POTENTIALLY HIGH RISK DEVICES <PHRPs) 

Although FDA firmly believes that its normal regulatory 
processes provide the necessary assurances that Y2K 
problems with high-risk devices will be carefully 
addressed, FDA implemented a plan to provide additional 
assurance to the public and healthcare facilities about the 
Y2K status of medical devices. FDA addressed concerns 
about the adequacy of the medical device industry's actions 
taken to avoid serious Y2K problems by independently 
validating their Y2K self-assessments. 

FDA developed and posted on the FDA Y2K website a list of 
types of potentially high risk devices (PHRDs) that are 
likely to be computer-controlled and that could present a 
significant risk of immediate harm to the patient should 
the devices fail to operate as expected due to a Y2K 
problem. The PHRDs list contains 90 types of potentially 
high-risk devices for which FDA has identified 803 PHRDs 
manufacturers. An FDA contractor contacted these 803 firms 
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and learned that approx iniately 60 percent have no 
computerized devices. 

FDA initiated a special study designated as a "Special Year 
2000 Data Gathering Request" to examine the Y2K programs of 
a random sample of potentially high-risk device (PHRD) 
manufacturers. Eighty of the PHRDs manufacturers were 
randomly selected for an on-site assessment by an FDA 
contractor with extensive experience in information 
technology and Y2K verification and validation. The study 
was designed to: 

• provide a high level of assurance that manufacturers have 
properly assessed the y2K status of their computer- 
controlled medical devices; 

• examine manufacturers' processes to evaluate how they 
assess the Y2K status of their products; 

• verify that the manufacturers have developed and properly 
validated appropriate upgrades to correct any Y2K 
problems for these devices; and, 

• confirm the information provided by manufacturers for the 
Federal Year 2000 Biomedical Equipment Clearinghouse 
database by examining the supporting documentation of the 
manufacturers . 

RESULTS OF PHRDs ASSESSMEHTS 

As of October 15, 1999, the contractor has completed all 80 
on-site reviews of records to assess the existence and 
adequacy of manufacturers processes and procedures 
implemented under a quality system. The assessments are 
intended to assure that potentially vulnerable devices have 
been adequately assessed and that upgrades are correctly 
implemented and appropriately tested and evaluated by the 
manufacturer. As part of this process, FDA is evaluating 
the reports as they are completed and to date has found no 
serious problems related to Y2K. The contractor will 
provide FDA with a final report of the assessments in early 
November. FDA will review the contractor's report and will 
issue a summary report in early November. FDA is confident 
that the evaluation of these manufacturers will demonstrate 
the thoroughness with which manufacturers have assessed and 
provided information and corrections for non-compliant 
products . 

Now that manufacturers should have completed their 
assessments of Y2K compliance status and identified non- 
compliant devices, FDA will review this information to 
identify any manufacturers of PHRDs for which information 
is not available, or whose non-compliant products pose an 
actual significant risk to patient health. For firms that 
have declined to voluntarily participate in the PHRDs 
assessments, if these firms have not been inspected 
recently by FDA, the Agency will consider by the middle of 
November whether an FDA inspection of the firm should be 
conducted, based on the possible level of risk that the 
product may present. In these situations, FDA will review 
the steps taken by the manufacturers to notify users 
regarding any problems that might exist and to assure that 
appropriate corrections are implemented. 

In any case where the action by the manufacturer has been 
inadequate to assure patient safety, FDA will use its 
statutory authorities to require corrections and publicize 
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the situations. FDA is prepared to take action which would 
include public advisories to device users, suggestions to 
manufacturers regarding voluntary recalls, mandatory 
recalls or seizure of the non-compliant devices in extreme 
risk situations. FDA expects, however, that the situations 
where such actions will be required will be rare as there 
are many incentives in addition to possible FDA regulatory 
action which lead manufacturers to address any such 
potentially high risk situations before FDA regulatory 
action is needed. 

PHARMACEUTICAL INDUSTRY AND Y2K COMPLIANCE 
FDA also has been examining the intersection of Y2K risk 
mitigation and the availability and quality of certain 
prescription drugs. In fact, government agencies and 
organizations within the pharmaceutical industry supply 
system (including manufacturers, distributors, pharmacies, 
hospitals, physicians, pharmacists, insurers and others) 
have been working closely together to prepare for the year 
2000 date change and its potential impact on the supply of 
pharmaceuticals . 


In an effort to obtain additional data on this issue, on 
April 21, 1999, the FDA Commissioner, Dr. Jane E. Henney, 
sent a letter to the Presidents and CEOs of approximately 
4,228 pharmaceutical manufacturers, which includes 
prescription, over-the-counter, and bulk drug 
manufacturers; distributors-repackagers; and, medical gas 
manufacturers. The letter requested their assistance in 
assuring FDA and the American public that their firms have 
addressed the Y2K problem as it affects the adequate supply 
of safe and effective drugs. Included with the letter was 
a "Y2K Assessment Survey" concerning the status of actions 
pharmaceutical firms have taken to address this issue and 
assess Y2K readiness within the pharmaceutical industry. 

The focus of this effort is on prescription products with 
emphasis on the priority firms (sole source, orphan and the 
top 200 prescribed products) . 

Survey of Pharmaceutical Manufacturers 

As of October 8, 1999, 3,132 or 74.1 percent responded to 
the survey, including 1,053 of the 1,070 or 98 percent of 
the prescription drug manufacturers that were surveyed. Of 
the approximately 274 priority manufacturers (160 - 
excluding subsidiaries) which includes sole source, orphan 
and top 200 prescribed, 270 or 99 percent have responded. 

Of the firms that completed the survey, 95 percent state 
they will be ready for Y2K by the end of October with both 
the foreign and domestic firms having a similar pattern of 
Y2K readiness. Priority companies who indicated a later 
date are being contacted to determine their Y2K readiness 
and to make sure they are on track for meeting their goals. 
FDA is committed to maximizing the response rate 
particularly from the 274 priority manufacturers. 

Pharmaceutical Audits 

Many have urged that FDA take additional actions beyond the 
survey program that will provide independent assurance of 
the adequacy of manufacturers' y2K assessments and any 
resulting Y2K corrections. As a result, FDA decided to 
have a contractor, with extensive experience in information 
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technology and Y2K verification and validation, audit each 
of the 160 highest priority pharmaceutical firms, as well 
as a random sampling of other drug manufacturers. The 
surveys, by the contractor via telephone or on-site 
interview, were begun on July 19, 1999. 

As of October 8, 1999, 88 percent of the assessments have 
been completed. It is important to note that to date the 
audit results have confirmed the findings of the survey. 
These results provide the basis for a clear message to 
reassure the American public that prescription drugs will 
continue to be available. 

FDA and the pharmaceutical industry will continue to 
monitor the Y2K status and availability of pharmaceutical 
supplies. FDA has processes in place to address product 
availability and has used these procedures to help get 
necessary products to patients. FDA will continue to work 
with the health professional community, industry and 
patient groups regarding Y2K readiness and product 
availability. 

BIOLOGICS INDUSTRY AND Y2K COMPLIAMCE 

Another section of the pharmaceutical industry produces 
biological drugs as well as vaccines and blood products. 

We took the same survey/audit approach with these 
manufacturers as well. 

Survey of Biologies Manufacturers for Y2K Manufacturing 
Processes 


On June 30, 1999, a survey was mailed to 1,576 licensed 
biologies manufacturers and registered blood 
establishments. Letters to the biologies trade 
organizations requesting their assistance in encouraging 
participation in the survey effort were sent on 
June 30, 1999. Of the responses that have been received, 

92 percent report that they will be Y2K ready by the end of 
October. 

As of October 15, 1999, we have received responses from 
1,483 or 94 percent of the firms. Highest priority has 
been placed on 110 priority firms, which include licensed 
manufacturers of vaccines, therapeutics, allergenic 
products, viral marker test kits and major blood 
organizations. As of October 15, 1999, 101 or 90 percent 
of the high priority firms have responded. 

Biologies Audite 

Telephone/site visit audits of these 110 high priority 
firms began in late August and as of October 14, 1999, 
audits have been completed for 83 or 75 percent of the high 
priority firms. To date, we have no reports of problems 
regarding firms that have been audited. We also have begun 
audits of a random sample of the firms that are not in the 
high priority group. As of October 14, 1999, we have 
completed audits of 48 of these firms with no problems 
Identified. 

CXWSUMABLE MEDICAL SUPPLY INDUSTRY AMD Y2K COMPLIANCE 

Survgy of Manufactursrs of Consumabla Medical Supplisa 

for Y2K Manufacturing and Distribution Procsssss 
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On June 18, 1999, surveys were mailed to 3,070 consumable 
medical supplies manufacturers (approximately 2, 000 
domestic, 1,000 foreign). The focus of the survey is on 
those manufacturers that produce essential medical devices 
that are used and consumed on a recurring basis during the 
delivery of essential healthcare services and whose 
availability is critical to the uninterrupted delivery of 
health care and patient welfare. The survey requests 
information on mission critical automated manufacturing and 
distribution systems rather than Y2K status information on 
specific products. A follow-up letter was sent to non- 
respondents on July 23, 1999. As of October 14, 1999, 

2,074 responses and/or returned mail have been received 
with approximately 90 percent of the fully analyzed 
responses (1309) reporting Y2K readiness by October 31. 

Consumable Medical Supplies Audits 

For a sample of survey respondents, validation of survey 
responses by the contractor via telephone or on-site 
interview is being conducted. Highest priority for these 
assessments will be the 225 manufacturers that produce a 
device only manufactured by 3 or fewer firms, so called 
"few sources" devices, and the 57 manufacturers that are 
the sole source for a supply (the 57 manufacturers are 
included in the 225) . Of the 225 "few sources" firms, 197 
have responded, and of the 57 sole source firms, 48 have 
responded. Attention also will be focused on those 
manufacturers with inconsistent responses. As of 
October 14, 1999, approximately 58 percent of the 
assessments of the priority firms have been completed with 
no serious problems reported. Eighty-nine percent report 
that they will be Y2K ready by the end of November. It is 
important to note that the initial audit results confirm 
the survey results. We will continue to follow-up with 
those manufacturers that are not Y2K ready and whose 
supplies, if not available, could have a significant impact 
on health care delivery. 

RECENT AGENCY WIDE OUTREACH EFFORTS 

The FDA website, including the Federal y2K Biomedical 
Equipment Clearinghouse database, provides much of the 
information needed by healthcare providers and consumers 
regarding y2K and FDA-regulated products. For answers to 
questions that can not be found on the Y2K website, FDA 
recently established a Y2K telephone hotline which can be 
reached by calling FDA's main information line toll-free at 
1-888- INFO-FDA or using the Y2K e-mail form on the FDA Y2K 
website. 

FDA also has developed an extensive outreach initiative 
that will provide video and audio news releases, brochures 
and articles designed to address the concerns of the 
consumer and the healthcare community regarding Y2K issues. 
Additional FDA outreach efforts are noted in the Appendix. 

CONCLUSION 

In summary, Mr. Chairman, there is now extrinsic and 
objective evidence that drug and device manufacturers have 
taken the necessary steps to ensure that their products and 
production facilities are ready for Year 2000 conversion. 
Indeed, I believe that manufacturers, wholesalers, and 
retailers of these products should be commended for taking 
this issue seriously and for devoting the necessary 
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resources to protect their customers and, ultimately, 
patients from Y2K related failures. For those few firms 
that have not taken these steps, FDA will be vigilant in 
following up on any reports. 

FDA will continue to work with other Federal agencies, 
patient groups, healthcare provider associations and 
industry to optimize data collection and information 
sharing. Together we can provide the American public with 
the needed assurances that manufacturers will be Y2K ready. 
We all share a common goal of having medical devices that 
will function as intended and a safe and adequate drug 
supply available for the American public as we continue 
through the year-end transition. 

Thank you for the opportunity to testify. 


Appendix 

Lmtbers to Medical Device Industry 

1»97 

• June 25, 1997, notice to all medical device 
manufacturers (8,322 domestic and 5,085 foreign) 
registered with FDA's Center for Devices and 
Radiological Health (CDRH) indicating that they needed 
to address this issue and review both embedded and 
non-embedded software products. 

1996 

• January 21, 1998, letter which was sent by DHHS to 
approximately 16,000 medical device and biomedical 
equipment manufacturers to ask them to voluntarily 
provide information on the Year 2000 compliance status 
of their products. 

• June 29, 1998, targeted, follow-up letter to specific 
manufacturers of potentially vulnerable computerized 
devices. 

• September 2, 1998, follow-up to the June 29, 1998, 
letter directed to the manufacturers of potentially 
computerized devices who had not responded to the 
previous requests. 

• August 14, 1996 and Septea^er 2, 1996, letters from 
Dr. Bruce Burlington, then Director, CDRH, and 

Dr. Friedman, then Acting Commissioner of the Food and 
Drug Administration, to the Health Industry 
Manufacturers Association (HIMA) requesting that the 
Association take aggressive and immediate actions to 
encourage and assist medical device equipment 
manufacturers in providing information to FDA. 

• Late September 1998, FDA posted on the website those 
manufacturers of selected product categories that are 
likely to Include vulnerable products that had not 
provided a response to FDA's inquiries. 

1999 

• March 3, 1999, letter requesting that the 2,300 
targeted bl<»iiedical equiiment manufacturers carefully 
review the Year 2000 status information that they have 
provided or intended to submit, and, where necessary, 
provide more specific information on non-compllant 
products . 
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• March 29, 1999, letter requesting that targeted 
medical device manufacturers submit a complete list of 
individual product models that are Year 2000 
compliant. Responses from 572 manufacturers have been 
received as of June 1, 1999. 

• July 16, 1999, Public Health Notification regarding 
date-related computer controlled medical devices to 
administrators, risk managers and biomedical/clinical 
engineers of 67, 000 hospitals and healthcare 
facilities. The notification urged them to develop 
contingency and remediation plans to avoid serious 
adverse events; provided Information to assist them in 
contingency planning; provided information about the 
Federal Y2K Biomedical Equipment Clearinghouse 
website; and, encouraged them to report problems or 
adverse events associated with Y2K and computer- 
controlled devices to FDA's MedWatch Program. 


Additional Outreach and Guidance 

In an effort to reach the widest group of individuals, both 
to get information and to spread information, CDRH also has 
been conducting extensive outreach to the device industry 
and to other consumers on this issue. These efforts are as 
follows: 

• CDRH's Division of Small Manufacturers Assistance 
provided an article in May 1998 entitled "Biomedical 
Equipment Manufacturers Urged to Share Year 2000 
Information" to 12 medical device trade press contacts 
and to 65 U.S. and 35 foreign medical device trade 
associations in order to facilitate the dissemination of 
information to their members regarding the website 
database and to encourage the posting of data by 
manufacturers. 

• The website and database were mentioned in the FDA Column 
of the June 3, 1998, Journal of the American Medical 
Association and in an article in FDA's Medical Bulletin 
that was sent to approximately 700,000 healthcare 
practitioners this past summer. 

• In the spring of 1998, CDRH developed a Guidance Document 
on FDA's expectations of medical device manufacturers 
concerning the Year 2000 date problem. The guidance is 
available on the FDA website. 

• FDA also developed an article addressed to the users of 
radiation treatment planning systems regarding the need 
to assess these systems. The article was published in 
the newsletters of relevant professional associations. 

• Staff of CDRH have participated in numerous conferences 
and video teleconferences devoted to the Year 2000 
problem in healthcare in order to communicate with 
healthcare facilities regarding the Biomedical Equipment 
Clearinghouse and the need to address the Year 2000 issue 
with devices. 

• March 29, 1999, memorandum issued by the Director, 
Division of Emergency and Investigational Operations, 
Office of Regulatory Affairs (ORA) , to the FDA field 
instructing investigators to expand the Year 2000 
activities to include asking questions regarding what the 
firm has done to assure that the computer controlled and 
date-sensitive products, manufacturing processes and 
distribution systems are Year 2000 compliant. 
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• On May 17, 1999, the President's Council on Year 2000 
Conversion in conjunction with the Veterans Health 
Administration hosted a Roundtable event. The discussion 
focused on those services and supply chains that are 
critical to the health and well-being of all Americans, 
and in particular the ready availability of 
pharmaceuticals from their manufacture to the filling of 
prescriptions at the drug store. The consensus of those 
present at the Roundtable (the brand name and generic 
drug manufacturers, wholesalers, and health care 
providers, payers, along with consumer advocates and 
government regulators) is that allowing patients to 
obtain a substantial advance (buying or stockpiling) is 
not necessary and may actually cause the shortage that 
this kind of action is trying to prevent. FDA continues 
to work with the pharmaceutical industry, associations, 
and other Federal agencies to assure a safe and adequate 
pharmaceutical supply. 

• In a letter to providers. Health Care Financing 
Administration (HCFA) noted the FDA website for providers 
to obtain information on medical devices and Y2K 
compliance status information. 

• FDA has participated in 18 national and regional HCFA 
conferences and three National Association of Rural 
Health Clinics regional conferences which included 
discussions of FDA's Y2K activities, status of the 
Federal Y2K Biomedical Equipment Clearinghouse, 
pharmaceutical supply issues and future Agency 
activities. 

• On April 16, 1999, a Guidance for Industry and the 
Clinical Community on "Medical Device Reporting for Date- 
Related Problems Including Y2K.'’ 

• On June 7, 1999, FDA participated in a President's 
Council on Year 2000 Conversion Roundtable event on 
medical supplies. 

• On August 18, 1999, FDA staff participated in a Health 
Resources and Services Administration (HRSA) 
teleconference entitled "Making Your Health Facility Y2K 
CoBg)liant" directed to HRSA funded rural health clinics. 

• On August 24, 1999, FDA issued a Talk Paper entitled "The 
Year 2000 Date Problem and Medical Devices." 

Although most devices ace regulated by craiH, FDA's Center 
for Biologies Evaluation and Research (CBER) regulates 
blood bank software, which is of particular concern for 
potential Year 2000 problems. In January 1998, CBER posted 
guidance for industry entitled "A Year 2000 Date Change for 
Computer Systems and Software Applications Used in the 
Manufacture of Blood Products" on the FDA website. The 
guidance provided specific recommendations to assist 
industry in its evaluation of computer and software systems 
used in the manufacture of blood products and to assist in 
evaluating the Impact of potential Year 2000 problems. 

CBER is aware of the status of these individual products 
and believes that the blood bank software will be Y2K 
compliant or will have a "patch" or "work-around" for the 
systems to ensure that the systems will work through Year 
2000. 
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STATEMENT BY 

THE HONORABLE HERSHEL W. GOBER 
DEPUTY SECRETARY 
DEPARTMENT OF VETERANS AFFiURS 

BEFORE THE 

SUBCOMMITTEE ON OVERSIGHT AND INVESTIGATIONS 
COMMITTEE ON VETERANS’ AFFAIRS 
U.S. HOUSE OF REPRESENTATIVES 

October 28, 1999 


Infroductlon 

It is my pleasure to testify on behalf of the Department of Veterans Affairs (VA) 
on the status of our readiness for the Year 2000. I am accompanied today by 
Harold Gracey, VA’s Acting Chief Infonnation Officer (CIO), and other key staff 
from VA’s OffK» of Information and Techrtology, the Veterans Benefits 
Administration (VBA), the Veterans Health AdministrEdion (VHA), and the 
National Cemetery ^ministration (NCA) who have been Invoived In Year 2000 
full-time for the last several years. 

We have worked very hard in VA to ensure that we will be ready for the Year 
2000. We have program delivery people and informEdion technology people 
working hand-in-hand across VA to ensure that we provide uninterrupted support 
of benefits delivery and health care services. 

I appear before you today to say I remain confident that benefit payments wiU be 
made without interruption, and our health care fadtities wiH be operational on 
January 1 , 2000. Veterans will continue to receive their benefits on time, as well 
as the highest quality of health care in the Year 2000 and beyond. 

Since the last hearing VA has conducted a number of post-implementation tests 
to provide added assurance that our systems will operate properly in the Year 
2000. VA has utilized Year 2000 simulated date environments, complete with 
third-party compliant software and hardware, to simulate system activity during 
the century transition and in the Year 2000 and beyond. 

One major accomplishment was the successful completion of a busine^ 
process simulation (BPS), conducted from July 3-6, 1999. During these tests, 
VA systems internal date settings were advanced to January 2000, Including 
veteran data, software applications, communications and computer plEdforms. 
Benefits and health care transactions were processed in order to simulate 
normal buslne^ activities in the Year 2000. Over $3.5 billion dollam in benefit 
payments were successfully processed in the simulated January 2000 payment 
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cycles. Over 125 VA personnel participated in this test. No Year 2000 problems 
were encountered dutirrg the simulation 

VA has also conducted additional post-implementation tests. Previously, in April 
1999, VA’s Office of Financial Management performed a series of tests to verify 
that the various systems involved in issuing payments to vendors and employees 
will wori< together properly in the Year 2000. In addition, in August 1999, VHA’s 
VISTA integrated suite of appiications was tested in a simulated forward-dated 
hospital environment to simulate normal medical center activity in the Year 2000. 
VISTA is the name given to the standardized set of national software 
applications that form the automated systems environment supporting integrated 
health care delivery at local VA health care facilities. 

Business Continuity and Contingency Plans 

Although VA has made its systems Year 2000 compliant, there remains a 
dependency upon products and sen/ices provided by third parties (such as water 
and electricity companies). VA has developed Business Continuity and 
Contingency Plans (BCCPs) to minimize Year 2000 impacts on its core business 
functions. 

In the event of any problems extemat to the Department, VA has classified its 
core business functions into two critical areas: health care (VHA) and benefits 
delivery (VBA). The BCCP for benefits delivery, including benefit payments, was 
compieted in January 1999. The Patient-Focused Year 2000 Contingency 
Planning Guidebook, VHA’s BCCP, was compieted in March 1999. 

VA’s regional offices and health care facilities were provided these pians and 
templates so that they could customize their individual plans according to their 
local needs. The customized extensions for VA’s three data processing centers, 
58 regional offices, and 172 heaith care facilities were completed in May 1999. 
VA health care facilities include hospitals, outpatient clinics, domiciliaries, and 
nursing homes, all of which have been included in local level BCCPs. These 
BCCPs will greatly mitigate the potential impacts on the delivery of benefits and 
health care by entities outside VA’s control. 

Day One Planning 

Our focus in the remaining days until the actual date rollover is making pre- 
rollover, rollover and post-rollover plans, commonly referred to as Day One 
Plans. VA has developed Day One Plans that identify comprehensive sets of 
actions to be executed during the last days of 1999 and the first days of 2000. 
The Day One Plans are designed to minimize any adverse impact on operations 
and key business processes, help protect data, applications and equipment, and 
improve the ability to recover should Year 2000 related problems be 
encountered. In addition, the Day One Plans are a mechanism for monitoring 
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and reporting VA’s Year 2000 experience to VA executive management, the 
President’s Council on Year 2000 Infonnation Coordination Center (ICC), 
veterans and their families. 

VA has developed a Day One Strategy Overview that provides a high level 
summary of VA's strategy to manage and mitigate the risks of potential Year 
2000 related disruptions to agency operations. I would be happy to provide a 
copy for the record. 

Because VA’s work supporting health care and benefits delivery is normally 
conducted at the local level nationwide, the authority to solve rollover problems 
has been delegated locally to the health care facilities, and to the regional 
offices. Local facilities and regional offices have the authority to execute 
appropriate contingencies, if they determine that a situation exists that requires 
the execution of the BCCP. 

VA’s recent focus has been the review and validation of our BCCPs at our local 
facilities. VHA has been performing a series of BCCP site visits to ensure the 
quality of BCCPs and preparations for Day One. Similarly, VBA has reviewed 
regional office BCCPs and Day One Plans. In addition to internal reviews, GAO, 
using on-sHe visits and document reviews, has reviewed many of VA’s health 
care facilities and regional office BCCPs. VA’s Office of the Inspector General 
has also completed a written survey of all VA facilities, and has performed 
selected site reviews at VA health care facilities and regional offices. 

As described in my April 15, 1999, testimony, it is important to point out two 
mitigation and preparatory activities that VA has completed or plans in order to 
help minimize potential Year 2000 disruptions to benefits and health care 
delivery -the date of benefit payments and the performance of emergency 
power drills. 

Date of Benefit Payments 

Most of the regular, recurring benefit payments, including Compensation and 
Pension, Education Chapters 32, 35, 1606, Vocational Rehabilitation, REPS, 
and spina bifida will be posted, as they normally would have been, to the 
beneficiaries’ accounts and will be available on the morning of December 30, 
1999. This will greatly mitigate possible Year 2000 interruptions of benefit 
payments. 

Conduct of Emergency Power Drills 

Each VHA facility has performed an emergency power drill to prepare for various 
power disruption scenarios. Each facility, under controlled conditions to prevent 
any harm to patients, supplied facility electrical power using the emergency 
generator system after disconnecting from the local electrical power supply for 
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up to ^ght hours. This drill demorrstrated that health care focHities could operate 
under emergency power, if necessary. Drills were completed by August 1999. 

D^MNlniwit TFMwiHy Testing and Payment ^tingwidM 

In May 1999, VBA conducted extensive Year 2000 testing that culminated with 
the transfer of payment files to the Department of the Treasury. During this 
testtng, over 35 payment files representing over $3.5 billion dollars were 
trananitted to toe Treasury. The Treasury toformed us that these (myments 
were processed conectty. The Treasury then tested the Compensation and 
Pens^ (CAP) files with toe Federal Rc^nre and 40 million CAP Electronic 
Fund Transfer payments were successfully processed. In addition. Treasury 
suocessfijily tested its ability to process and issue paper checks currently made 
to beneficlarim. 

In addition, we have several contingencies in place with Treasury in the unlikely 
event of a problem. In fact, an entire subset of our BCCP for benefits delivery 
deals wito Treasury issues to ensure that beneficiaries wHI receive their benefit 
payments on tbne and correctly when the new century begkis. These (dans 
include a worst case scenario in which toe private banking electronic systems toil 
or have problems. If this occurs. Treasury can revert to the use of paper checks 
to deliver veterans payments after recertification of those payments by VA. In 
addition, if the VA systems cannot process payrrtents in January 2000, we will 
provide a conttogency payment file for Treasury's use so that they can generate 
veterans' payments. We feet these are unlikely events, but we are ready with 
contingencies in case they are needed. 

Based on the tact that both VA and FMS and the Federal Reserve System are 
already Year 2000 ready, and thcd we have thoroughly conducted post- 
implementation testing, I am confident that all benefit payments will be made 
without interruption in toe Year 2000 and beyond. 

Medieal Devices 

The potential Year 2000 Impact on medicat devicas is a national issue, affecting 
both private sector and Federal health care communities. VA, like any other 
health care provider, buys these devices frc»n private industry. The Food and 
Dn^ Ackntoistretion (FDA) regulates these produm. 

Medical Device Status 

Af^roxknately two years ago, VHA identified about 1600 vendors from wtokto the 
merflcal frK^Wes have procured medical devices. This nutrtoer «res techiced to 
1379 through research, discussion with medicai er^neere at VAMCs, and 
contact with vendors/distributore. Distributors and manufacturers that do not 
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produce biomedical devices were removed from the database. To date, we have 
received responses from more than 99% of the manufacturers. 

VHA estimates that over 96% of the devices provided by these manufacturers 
that we use are compliant, about 3% are conditionally compliant (meaning a fix 
or upgrade will be provided by the manufacturer) and less than 1% are non- 
compliant. 

Consolidated Mail Outpatient Pharmacy (CHOP) 

The Consolidated Mail Outpatient Pharmacy (CMOP) is a regional system 
composed of seven facilities that is used to expedite the processing and 
distribution of mail-out prescriptions to veterans. More than 50% of VHA 
prescrifiMons are filled by the CMOPs. 

As of September 30, 1999, VHA had completed the Year 2000 repairs and 
testing of the seven CMOPs. The renovation strategy consisted of the repair of 
non-compliant systems as well as the implementation of new systems. Two of 
the seven CMOPs are now running new non-proprietary, state-of-the-art software 
that operates on a more user-friendly, fully compliant platform and thus are 
capable of filling a higher volume of prescriptions. All the CMOPs renovation 
work was performed without compromising the filling and distribution of 
prescriptions to veterans. 

As part of the VHA Year 2000 project, the CMOPs have developed Year 2000 
contingency plans to supplement their existing National Disaster and Recovery 
plans. The CMOPs have also tested all the hardware, software interfaces, and 
contingency plans with the medical facilities. The contingency plans address the 
phannaceutical supply chain, and the readiness of pharmaceutical 
manufacturers, utility companies, and other suppliers the CMOPs depend on for 
their operation. 

The CMOPs are fully Year 2000 compliant and we are confident there will be no 
interruption in filling prescriptions for veterans into the next century. 

Moratorium 

VA has established a nationwide moratorium on the implementation of new 
systems, changes to existing systems or third-party upgrades between October 
15, 1999 and March 31 , 2000. Our goal is to ensure that we do not introduce 
Year 2000 vulnerabilities or defects into our Year 2000 certified systems. The 
only erariusions to the moratorium are changes to correct Year 2000 related 
problems, repairs for other production problems, cost-of-living adjustments, and 
changes required by legislative mandates. This nationwide moratorium ensures 
that our information technology environment will remain stable during the rollover 
to the next millennium and beyond. It is necessary to ensure that VA will 
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continue to provide unintemipted services to veteiwis aiKl the communities that 

VfV WIW* 


Sutmnary 

VA has made its systeira supporting health care and benefHs deOvery Year 2000 
compliant VA has completed successfully the necessary testing for troth the 
veterarro’ benefits md high impact health care programs, and we tael confident 
tlrot these iHognuns are ready for ttte Year 2000 and b^^ond. VAiriaohas 
completed BCCPs to provide for unintemipled health care and benefits deNvery. 

VA is making preparations for the upcoming Year 2000 date rolover to ensure 
benefit pc^menls wiM be made wttwut intenuplion and that VA heiMi care 
tacMioswIbeoperalionalon January 1,2000 md beyond. OurNalion's 
veterans and their tamiiies wM continue to raoeivs their benefits on time, as wsN 
as the Mghest quality of health care. Ithmkyouforthisopportunlhftopreaent 
our progress In preparing for the Year 2000. I woiM be haj^ to answer any 
questions you have. 
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